In which languages are passwords easiest to crack?

Although a lot has been written about this, but many users continue to use rather predictable passwords to protect themselves online, says The Economist.

Passwords such as '12345'; 'password'; and the like are easy to remember but also easy for attackers to guess, especially with programs that automate the process using lists ('dictionaries') of common choices, it says.

Cambridge University computer scientist Joseph Bonneau has recently published an analysis of the passwords chosen by almost 70 million Yahoo! users.

The study shows what percentage of accounts could be cracked after 1,000 attempts using such a dictionary. One particularly interesting twist is how little difference using language-specific dictionaries makes.

It is possible to crack roughly four per cent of Chinese accounts using a Chinese dictionary; using a generic dictionary containing the most common terms from many languages, that figure drops only slightly, to 2.9 per cent, says The Economist.

...

Indonesian

Passwords guessed using same-language dictionary: 14.4 per cent

Passwords guessed using different-language dictionary: 9.3 per cent

In cryptanalysis and computer security, a dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching likely possibilities.

...

Italian

Passwords guessed using same-language dictionary: 14.2 per cent

Passwords guessed using different-language dictionary: 7.2 per cent

A dictionary attack uses a targeted technique of successively trying all the words in an exhaustive list called a dictionary (from a pre-arranged list of values).

...

Vietnamese

Passwords guessed using same-language dictionary: 14.1 per cent

Passwords guessed using different-language dictionary: 7.8 per cent

In contrast with a brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words for example a dictionary (hence the phrase dictionary attack) or a bible, etc.

...

Greek

Passwords guessed using same-language dictionary: 12.7 per cent

Passwords guessed using different-language dictionary: 8.6 per cent

Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (seven characters or fewer), single words found in dictionaries or simple, easily predicted variations on words, such as appending a digit.

...

Spanish

Passwords guessed using same-language dictionary: 12.1 per cent

Passwords guessed using different-language dictionary: 6.9 per cent

However these are easy to defeat. Adding a single random character in the middle can make dictionary attacks untenable.

...

Portuguese

Passwords guessed using same-language dictionary: 10.5 per cent

Passwords guessed using different-language dictionary: 5.1 per cent

It is possible to achieve a time-space tradeoff by pre-computing a list of hashes of dictionary words, and storing these in a database using the hash as the key.

...

French

Passwords guessed using same-language dictionary: 10 per cent

Passwords guessed using different-language dictionary: 5 per cent

This requires a considerable amount of preparation time, but allows the actual attack to be executed faster.

...

English

Passwords guessed using same-language dictionary: 8 per cent

Passwords guessed using different-language dictionary: 7.9 per cent

The storage requirements for the pre-computed tables were once a major cost, but are less of an issue today because of the low cost of disk storage.

...

German

Passwords guessed using same-language dictionary: 6.3 per cent

Passwords guessed using different-language dictionary: 3.5 per cent

Pre-computed dictionary attacks are particularly effective when a large number of passwords are to be cracked.

...

Korean

Passwords guessed using same-language dictionary: 5.8 per cent

Passwords guessed using different-language dictionary: 2.8 per cent

The pre-computed dictionary need only be generated once, and when it is completed, password hashes can be looked up almost instantly at any time to find the corresponding password.

...

Chinese

Passwords guessed using same-language dictionary: 4.2 per cent

Passwords guessed using different-language dictionary: 2.9 per cent

A more refined approach involves the use of rainbow tables, which reduce storage requirements at the cost of slightly longer lookup times.