# Strength Analysis of Real-Life Passwords Using Markov Models
## 6 Discussion
### Effectiveness of the Approach
#### 6.2.2 Results  
We started every password cracking cycle by running the passwords through Hashcat's dictionary attack process. The results of the cracking process for every cycle for the three different models are shown in Table 8.  
Table 9 shows the results of the cracking process for the universal Markov model.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Password Category**} & \multicolumn{3}{c}{**Attacking Technique**} & \multirow{2}{*}{**Total**} \\  & **Dictionary** & **Dictionary + Rules** & **Markov Mode** & \\ \hline Weak & 462 (92.4\%) & 4 (0.8\%) & / & 466 (93.2\%) \\ Medium & 96 (19.2\%) & 150 (30\%) & / & 246 (49.2\%) \\ Strong & 2 (0.4\%) & 153 (30.6\%) & / & 155 (31\%) \\ \hline \hline \end{tabular}
\end{table}
Table 8: Password cracking results for the three different Markov models.  
**Multiple different models** Expectedly, in the category of weak passwords we managed to crack almost all of the passwords. With the first dictionary attack, we managed to crack 462 weak passwords or 92.4%. Following, we used a dictionary attack with additional rules (these were mostly basic mangling rules) where we managed to crack additional 4 passwords (0.8%). Surprisingly, with the Markov mode, we didn't manage to crack any passwords. The first cracking cycle took one day to complete i.e., we managed to crack 466 (96.4%) weak passwords in just one day.  
The second cycle of cracking passwords from the category of medium passwords gave even more promising results. With the basic dictionary attack we managed to crack only 96 medium passwords (19.2%) and with the second attack with additional mangling rules, we cracked additional 150 passwords (30%). In the second cycle we ended up with a total of 246 (49.2%) cracked medium passwords.  
In the third and final cycle, we managed to crack 155 (31%) passwords that were identified as strong. We cracked the passwords with the dictionary attack followed by additional more complex mangling rules. The Markov mode attack did not manage to crack any of the strong passwords.  
In the scope of this additional experiment with multiple different Markov models, we managed to crack overall 466 passwords from the weak category, 246 from the medium, and 155 from the category of strong passwords. As evident from the descriptive statistics of the results, our Markov models are able to distinguish between at least three different categories of passwords (i.e., strong, medium, or weak).  
**Universal model** The situation with the universal Markov model was completely different. As we can see from Table 9 we managed to crack only 11.8% of the weak passwords. In the second and third cycle we cracked even fewer passwords: only 5.4% of the medium and 5.2% of the strong passwords. Most of the passwords were cracked with the dictionary attack with additional mangling rules. Surprisingly, with the Markov mode, we also didn't manage to crack any passwords. Overall, we cracked a total of 112 passwords out of 1500 selected. The number of cracked passwords with this approach is far lower than the other approach where we used three different Markov models. Even more, the number of cracked passwords between each category is almost the same, especially between the category of medium and strong passwords (27 and 26 accordingly). This gives the indication that the ultimate model has difficulties with categorizing medium and strong passwords and probably undergoes the \"overfitting\" process, where it can no longer distinguish between new passwords that are supposed to be strong and already known ones that are supposed to be weaker.