Dictionary attack

Technique

A dictionary attack is based on trying all the strings in a pre-arranged listing. Such attacks originally used words found in a dictionary (hence the phrase dictionary attack); however, now there are much larger lists available on the open Internet containing hundreds of millions of passwords recovered from past data breaches. There is also cracking software that can use such lists and produce common variations, such as substituting numbers for similar-looking letters. A dictionary attack tries only those possibilities which are deemed most likely to succeed. Dictionary attacks often succeed because many people have a tendency to choose short passwords that are ordinary words or common passwords; or variants obtained, for example, by appending a digit or punctuation character, which are easily covered by modern cracking software pattern generation. A safer approach. is to randomly generate a long password (15 letters or more) or a multiword passphrase, using a password manager program or manually typing a password.

Dictionary attacks can be deterred by the server administrator by using a more computationally expensive hashing algorithm. Bcrypt, scrypt, and Argon2 are examples of such resource intensive functions that require significant computational power to process, allowing for large improvements in security against dictionary attacks. While other hashing functions, such as SHA and MD5, are much faster and less expensive to compute, they can still be strengthened by being applied multiple times to an input string through a process called key stretching. An attacker would have to know approximately how many times the function was applied for a dictionary attack to be feasible.