So if you have a cluster of 32 of these machines, you may be able to crack the password within less than 2 years for sure. On average this means, that an 8 character password will be cracked within about 32 years of calculating hashes on the before mentioned system with 8 quite fancy (by today's standards) GPU's. of course you might get lucky and your first guess is the right one, but you can see where this is going.

For an 8 character password without any policy limiting the possible permutations, we are already talking about 3'025'989'069'143'040 possible passwords! At a rate of 1.5 Million passwords per second (that's what the 8 GPU server achieved using John the ripper), it would still take about 64 years to test all possible permutations for a single user. So again, once we are past the wordlist approach and we need to start brute-forcing, things get time consuming. so be careful what you wish for by publishing password policies )

So ironically, the more restricting your policy, the less permutations are possible and the easier it is to crack your password. Now if we know a password policy, that actually might help to narrow down the possible passwords and accelerate the brute force attack slightly by being able to remove un-allowed passwords (like for example all passwords that don't contain at least one upper and lowercase letter and digit, if our policy demands all three are present in a password). Once the wordlist based approach fails, the only option left to track is to brute-force the password, which means, to try all possible combinations of all possible characters of a password. Well Spoiler alert: the myth is absolutely busted, IF your password is a safe password, meaning, it is not on a password list and of significant length. So finally i took this opportunity to verify or bust the myth, that a teenager with a gamer notebook can crack your password hash in a few hours. One of them was a 128 core AMD ROME based server, the other one one was a GPU server with 8x NVIDIA RTX 2080Ti in it. I was recently tasked with stress-testing some systems in our lab with significant compute power. I am not a security expert and by no means a Hacker, but i've wanted to try the script-kiddie approach myself hands on for a long time already. Basically what I heard recited by many was, that a kid with a fast gamer notebook with a decent graphics card could brute-force a password hash within hours by leveraging the power of the GPU. I often hear rumors about how fast a password hash (such as a linux passwd/shadow hash) can be cracked today by using modern GPU's.

John the ripper password list download