Is Windows More Secure Without a Password?

Sun, 09 Mar 2008 05:28:18 PST

When I first heard of this news it didn't seem right so I did a little testing on the subject to check if this was true. The way this works according to researcher's is that when a user creates an account without a password it will not be accessible on the network or via the Internet, they compared the results to accounts with bot strong (using long pass phrases) and weak passwords (for example abc1234). I used a tool to demonstrate the difference in the passwords time to be brute forced (the tool can be found here). And the results are staggering to say the least.

On a weak password (3 letters 4 numbers) it would take:

Your password is 7 characters long and has 175,760,000 combinations.
It takes 0.00 hours or 0.00 days to crack your password on computer that tries 25,769,803,776 passwords per hour. This is based on a typical PC processor in 2007 and that the processor is under 10% load

On a strong password (5 letters 3 numbers and 3 special characters) it would take:

Your password is 10 characters long and has 38,932,892,876,800 combinations.
It takes 755.40 hours or 31.47 days to crack your password on computer that tries 25,769,803,776 passwords per hour. This is based on a typical PC processor in 2007 and that the processor is under 10% load.

So as you can see that is a huge difference in time.

But back to the point in hand. I decided to test what the researcher's had found using 3 tools Nessus, Nmap and Cain & Able (I know they are for script kiddies). Using these tools I set up 2 extra computers on my private network.

Once they where all set up I loaded them up and began testing and what I found disproved what the researcher's said. When using them I could access both the passworded machine and the un-passworded. This shows that you need a strong password on your machine to protect it. The results will be posted up soon when I get round to uploading them. But on both machines I could get full access to everything on them. I will soon test the Internet security of this soon and let you know how it went.

So please for the sake of your privacy password your machines and stay safe online.