Chapter 3 · 1988–2009

The guessing

Hashing protected the file. It did nothing about humans choosing 'password.' So an entire industry grew up around guessing.

Chapter 2 ended on the crack in the armor: the math protects the file, but the human still picks the password, and humans pick badly. This chapter is what attackers built in that gap — a guessing industry that has never once stopped winning.

It announced itself in November 1988. A Cornell graduate student named Robert Morris — yes, that Morris, son of the password-paper author — released a self-replicating program that spread across the early internet and knocked out roughly a tenth of it in a day. Among its methods: a built-in list of a few hundred likely passwords, tried against every account it could reach. It worked constantly, because the list matched how people actually chose. The worm earned the first felony conviction under the new Computer Fraud and Abuse Act and, more usefully, created the field of incident response — the first CERT was stood up in its wake. The defense from chapter 2 and the attack in chapter 3 were written by the same family.

Then guessing got tools. In 1991 Alec Muffett released Crack, and password auditing became a category: point it at your own hashed file, let it run dictionaries and mangling rules, and see whose passwords fall. The framing was defensive — find the weak ones before an attacker does — but the engine was identical to the attacker’s. From here the two sides run the same arithmetic forever. Defenders reach for slower hash functions to make each guess cost more; attackers reach for faster hardware to make more guesses. The tools kept coming — John the Ripper, L0phtCrack, eventually Hashcat riding gaming GPUs to billions of guesses a second.

Try the losing side of that race below. Pick a password and watch the estimated crack time against a modern rig. The lesson is rarely what people expect: length beats complexity, badly. “P@ss1!” falls in moments; a long string of ordinary words holds for years. Every symbol-soup rule the next chapter forces on you is fighting the wrong variable.

The attackers’ real breakthrough wasn’t a tool, though. It was a map. In December 2009 a company called RockYou was breached, and because RockYou had stored its 32 million passwords in plain text — no hashing, chapter 2 apparently unread — the attackers didn’t just get accounts. They got the definitive census of how humans choose secrets. “123456” led, then “12345”, then “password”. Every modern cracking dictionary is a descendant of that file, ranked by real-world frequency. Defenders got something too: the breached-password lists that chapter 4’s reformed guidance would eventually tell everyone to check against. One spill armed both sides for a decade.

Sit with the shape of the era, because it sharpens the thesis. Every defense in this chapter — hashing, slow functions, auditing tools — improves the management of the secret. None of them can fix the secret, because the secret is chosen by a tired human who wants to log in and get on with their day. Which set up the industry’s most expensive mistake: instead of accepting that humans choose badly and designing around it, the industry decided to order humans to choose better. It wrote rules. It mandated symbols and rotation. And it made everything measurably worse for fourteen years — chapter 4.