Improvements in computing technology keep increasing the rate at which guessed passwords can be tested. For example, in 2010, the Georgia Tech Research Institute developed a method of using GPGPU to crack passwords much faster. Elcomsoft invented the usage of common graphic cards for quicker password recovery in August 2007 and soon filed a corresponding patent in the US. By 2011, commercial products were available that claimed the ability to test up to 112,000 passwords per second on a standard desktop computer, using a high-end graphics processor for that time. Such a device will crack a six-letter single-case password in one day. Note that the work can be distributed over many computers for an additional speedup proportional to the number of available computers with comparable GPUs. Special key stretching hashes are available that take a relatively long time to compute, reducing the rate at which guessing can take place. Although it is considered best practice to use key stretching, many common systems do not.
In December, 2012, William Cheswick wrote an article published in ACM magazine that included the mathematical possibilities of how easy or difficult it would be to break passwords that are constructed using the commonly recommended, and sometimes followed, standards of today. In his article, William showed that a standard eight character alpha-numeric password could withstand a brute force attack of ten million attempts per second, and remain unbroken for 252 days. Ten million attempts each second is the acceptable rate of attempts using a multi-core system that most users would have access to. A much greater degree of attempts, at the rate of 7 billion per second, could also be achieved when using modern GPUs. At this rate, the same 8 character full alpha-numeric password could be broken in approximately 0.36 days (i.e. 9 hours). Increasing the password complexity to a 13 character full alpha-numeric password increases the time needed to crack it to more than 900,000 years at 7 billion attempts per second. This is, of course, assuming the password does not use a common word that a dictionary attack could break much sooner. Using a password of this strength reduces the obligation to change it as often as many organizations require, including the U.S. Government, as it could not be reasonably broken in such a short period of time. 153554b96e