# Strength Analysis of Real-Life Passwords Using Markov Models
## 6 Discussion
### Effectiveness of the Approach
#### 6.2.1 Environment Setting  
We tested the cracking resistance for 1500 of the best-ranked passwords from our testing dataset. We selected these passwords based on the score given by three of our models. We classified these passwords in the categories of _strong_, _medium_ and _weak_ in the following way: 500 of the best ranked passwords scored by our best-ranked model _10_million_passwords_ were classified as _strong_ passwords, 500 of the best ranked passwords scored by our middle-ranked model _hotmail_ were classified as _medium_ passwords, and 500 of the best ranked passwords scored by our worst-ranked model _scribd_ were classified as _weak_ passwords. We did a similar selection for the universal model: we selected the top 500 passwords that were scored by the universal model as _strong_, 500 that were scored as _medium_, and 500 that were scored as _weak_.  
For testing the cracking resistance of the selected passwords we used Hashcat [34] and its abilities. Hashcat is an open-source tool (MIT License) and its functionalities are generally available. It can also be used in Markov mode for cracking passwords which is useful for our efficiency testing since the password guesses in Markov modes are built with the use of Markov models.  
Since Hashcat works only on hashed data, we hashed the selected passwords with MD5 hashing algorithm, before we ran them through Hashcat. We performed three password cracking cycles-one for every category of passwords. In every cycle we ran the same sequence of password cracking techniques: (1) dictionary attack, (2) dictionary attack with additional mangling rules, and (3) Markov mode attack. The first password cracking technique is a basic dictionary attack, the second is a dictionary attack with additional mangling rules that are already implemented in Hashcat, while the third is a technique that is based on Markov models. It is important to note that for the dictionary-based password cracking techniques we used all our training files that we used to train our [PERSON] models on.  
We expected to crack all the weak and most of the medium passwords in a relatively short time, but for the strong passwords, we expected it would take a much longer time. For the purpose of this experiment we only need to prove that the passwords that our models identified as weak passwords can be cracked in a lot shorter period of time regarding the passwords that were identified as strong. Considering this, we decided to run all cracking techniques for the same amount of time-2 weeks for every password cracking technique-and count the number of cracked passwords from every password category. By analysing the number of cracked passwords from every category, within the same period of time, we can confirm whether those passwords are weak, medium or strong.  
The last password cracking technique based on Markov models took more time to complete since the [PERSON] model needs to be trained first. For training the model we used our best training dataset-_10_million_passwords_. Because of space and memory sparsity (the size of the final Markov file with password suggestions has grown to almost 350 GB), we let Hashcat work for 2 days and build the Markov model. We piped the generated results from the Markov model into Hashcat and performed the password cracking technique.  
It is important to note that all parts (cycles) of the experiment were performed with the same technical equipment and in the same time period in order to preserve the continuity and the soundness of the experiment. We used Intel(R) Core(TM) i5-3550 processor on 3.30 GHz and 24 GB of RAM with 64-bit Windows 10 operating system.