Cracking passwords for good, bad & commercial purposes: second thoughts on password cracking

The talk opens with a long-running debate at PasswordsCon about whether cracking leaked password hashes is ethical and legal. To show how much one credential can be worth, the speaker recalls a hijacked news agency account that posted a fake explosion alert and briefly moved markets. He then shares lighter research on predictable choices, including birth years, personal interests and Android unlock patterns, and argues that biometric unlock still depends on a strong PIN as a fallback.

Co-presenter Jeremy Gosney leads an audience exercise to threat model password security. The group lists threats such as physical theft of databases, malicious insiders, online brute force, keyloggers, SQL injection, phishing and remote code execution, then checks which ones length and complexity would actually stop. Most fall outside what hashing or strong choices can defend against, since an attacker with code execution or access to plaintext bypasses them. Reuse is the clear exception, and unique passwords, ideally generated by a password manager, address the widest set of threats.

The closing section covers caveats: human-chosen strength is hard to measure, a password manager's master password should rely on a slow key derivation function, and a keyed hash held in a hardware security module protects stored credentials on the service side. The session ends with a pessimistic note about the field's direction, with the expectation that standards such as FIDO2 may eventually replace passwords.