Study Finds Your Passwords Are Getting Easier To Crack Thanks To AI And GPUs
To understand the report, here's a little background on the technique used by hackers. As a security measure in the event of a data breach, websites don't store passwords directly in a database; rather, they transform these passwords into random characters through a process called hashing. For example, let's say your password is Hot2025hard-ware. After hashing this password, it might be saved in a database like M176hja8739sheb725398nsjfetwuha63, making it difficult for hackers to know the actual passwords.
To bypass this hurdle, hackers create a long list of all possible combinations of characters and hash them into strings using the same tool used by the website. Thereafter, they try to match the hashed combinations with the strings obtained from the data breach. A match will then reveal the characters that made up the original passwords in the data breach.
The research results highlight the effect of AI and GPUs with high processing power on password-cracking time. As seen in the chart below, ChatGPT 3 (hardware A100 ×10,000) will take only two months to crack an 8-character password containing numbers and lowercase and uppercase letters. It's even easier if the password has been stolen before, uses dictionary words, or is repeated between websites.
Regardless of what combination or number of characters make the password, it is at risk of being instantly cracked by a hacker, based on the password table. If hackers were to get hold of a high-power GPUs like 20,000 A100 chips, cracking passwords would become much easier, as they could crack longer character passwords in a shorter time.
It's noteworthy to mention that the findings of this report are based on the assumption that the passwords are generated randomly. It doesn't cover instances of commonly used passwords, which are predictable and thus easier to crack.
We can expect that AI and graphics processors will continue to advance, meaning passwords will also get easier to crack. While tech companies like Microsoft are already shifting from passwords to passkeys, using passwords is still common. Hence, you are encouraged to use stronger password practices to stay safe. That means longer passwords (at least 12 characters including numbers and symbols). Additionally, where it is available, users are advised to use passkeys.
