8 character passwords are now easily crackable, change the default to 12

[matlads]

According to the password table published by hive systems, even the most secure 8 character passwords generated by this tool are now crackable within 5 minutes.

The link above explains how they came up with the table. Since the password table changes every year, I would like to include the table as it stands this year (2023) into this issue.

Number of characters	Numbers Only	Lowercase Letters	Upper and lowecase Letters	Numbers, Upper and lowecase Letters	Numbers, Upper and lowecase Letters, Symbols
4	Instantly	Instantly	Instantly	Instantly	Instantly
5	Instantly	Instantly	Instantly	Instantly	Instantly
6	Instantly	Instantly	Instantly	Instantly	Instantly
7	Instantly	Instantly	1 sec	2 secs	4 secs
8	Instantly	Instantly	28 sec	2 mins	5 mins
9	Instantly	3 secs	24 mins	2 hours	6 hours
10	Instantly	1 min	21 hours	5 days	2 weeks
11	Instantly	32 min	1 month	10 monts	3 years
12	1 sec	14 hours	6 years	53 years	226 years

I think we can no longer adhere to the nist recommendation of 8 character passwords.

The NIST document linked to above was updated to include the

Removal of pre-registered knowledge tokens (authenticators), with the recognition that they are special cases of (often very weak) passwords.

Since passwords are still very much in use, I am raising this issue so that we can consider moving the default length of the passwords generated by pwgen to 12 instead of 8.

[tytso]

If you read the full report, they are assuming that a password is "crackable" assuming that it is hashed using MD5. MD5 is an ancient cryptographic checksum, which is widely considered to be insecure, precisely because passwords can be cracked in seconds[1].

[1] https://security.stackexchange.com/questions/19906/is-md5-considered-insecure

There are no doubt some legacy systems that may still be using MD5 for hashing passwords. But more modern systems don't do this. For example, BitWarden uses 600,001 iterations of the KBPDF2 algorithm[2], which is vastly more secure than bare MD5. Bitwarden will be soon switching to using Argon2 for its password hashing, which requires using far more memory than can be used in a graphics card, to avoid hardware acceleration for brute force cracking[3]. The tradeoffs for using these more secure password hashing algorithms is that on older / cheaper mobile devices, the time for the legitimate user to do the password hash might delay their login by a second or more, which is not a great user experience. (On the other hand, it's probably less painful than having to type a 16 character purely random string....)

[2] https://en.wikipedia.org/wiki/PBKDF2
[3] https://stytch.com/blog/argon2-vs-bcrypt-vs-scrypt/

In any case, the Hive Systems report is clickbait, because MD5 has been known to be weak forever, and no competent system designer would be using MD5 in the twenty-first century. And all of this assumes that the hash is available to the attacker. Many systems do not expose the hash to the attacker, and if you try more than a small handful (3 to 10) bad passwords, the account is locked. This also prevents brute force attacks.

Since pwgen doesn't know whether or not you are trying to use a system which has been competently engineered or not, it doesn't make sense to change pwgen's defaults assuming an incompetently designed system. After all, such systems probably of far worse security vulernabilities, since I wouldn't trust any system designed by someone who thought using MD5 in the post-2000 era was a good idea.....

[matlads]

I agree with most of these points.

Closing this issue.