The One With The Foreign Wordlist

The speakers argue that password cracking research leans heavily on English words and names, which leaves passwords built from other languages under-tested. They make the case for lean, targeted wordlists over huge general ones, since large lists waste time against slow hashes. Their advice is to keep base words simple and let hashcat rules generate the variations on the GPU.

The first technique covers transliteration. Many people type words from their own language on a Latin keyboard the way the words sound, so a Russian or Greek word may appear as a phonetic Latin spelling. The speakers ran an English dictionary through a cloud translation service to produce phonetic Latin versions for several languages, then added rules for common letter habits, such as swapping a letter for a visually similar one. A second technique covers keyboard layout mismatches. A word typed on one language's layout while the system is set to another produces what looks like random characters, which can be mapped back to real words with a small tool they built. They also presented a tool that turns words into emojis, including combinations and skin tone modifiers, and used n-gram text sources to generate phrases.

The talk closed with practical notes. Emoji passwords are increasingly common because phones make emoji entry easy, and websites may count emojis differently toward length rules. Results on public hash lists were limited, but the speakers expected better yield against corporate hashes where multiple keyboard languages are in use. The takeaway is to tailor base wordlists to the target's language and keyboard, and to rely on rules rather than bigger lists.