PassGPT - New AI Model Trained on Millions of Compromised Passwords

LARRUZ explains PassGPT, an AI model trained on millions of leaked passwords from rockyou, LinkedIn, Yahoo, and Adobe. It generates passwords character by character and can estimate password strength, but raises concerns about misuse and legal risks.
Questions this video answers
June 17, 2023.
Researchers from ETH Zurich Swiss Data Science Center and SRI International (New York).
GPT-2 (OpenAI framework).
rockyou, LinkedIn, Yahoo, Adobe (and other massive leaked-password collections).
Progressive sampling (character-by-character generation).
Chapters
What if your passwords are not just sequences of random characters, but the product of an intelligent process learning from millions of past mistakes? Welcome to the era of PASS GPT, an AI model redefining the way we approach password security, turning our past vulnerabilities into our strongest armor. PASS GPT is a new AI model that is changing the way we secure our passwords. It learns from millions of compromised passwords that have been leaked in the past. But before we dive into the details of PASS GPT, let me give you some context and background on why password security is so important and what are the challenges that we face in creating and managing passwords. As you know, passwords are the keys to our online accounts and identities. They protect our personal information, our financial transactions, our social media interactions, and so much more. But passwords are also vulnerable to attacks from hackers who want to steal our data and compromise our security. Hackers use various methods to crack passwords, such as brute force attacks, dictionary attacks, phishing attacks, and so on. To prevent these attacks, we need to create strong and complex passwords that are hard to guess and easy to remember. But this is easier said than done. Password, please.
War Machine. Rocks with an X. All caps.
Many people still use weak and simple passwords that are based on common words, names, dates, or patterns.
Big boobs. You're typing big boobs. I'm trying everything.
Try big boobs with a Z.
That's the password we're in.
These passwords can be easily cracked by hackers who have access to large databases of leaked passwords from previous breaches. In fact, according to a study by Google, 66% of Americans admit to using the same password across multiple accounts. This is where AI and machine learning become useful. These are powerful tools that can help us improve our password security by generating and guessing passwords that are more secure and robust.
It's asking for a password password. Dukovich is a dick. All caps except dick is lowercase.
AI models can analyze millions of passwords and learn from their patterns, similarities, and vulnerabilities. They can then create new passwords that follow the latest security standards and include a combination of upper and lowercase letters, numbers, and special characters. But not all AI models are created equal. Some models are better than others at generating and guessing passwords. And this is where PASS GPT stands out from the crowd. PASS GPT is a new model developed by researchers from ETH Zurich Swiss Data Science center and SRI International in New York. It's based on the GPT2 framework by OpenAI, which is a large language model LLM that can generate natural language texts on various topics. PASS GPT is trained on a massive dataset of millions of leaked passwords from various sources such as rockyou, LinkedIn, Yahoo, Adobe, etc. These passwords are used as input texts for the model to learn from their features and generate new passwords based on them. But what makes PASS GPT different from other models is that it uses a technique called progressive sampling to build complex passwords on a character by character basis. Progressive sampling means that PASS GPT generates each character of a password based on the previous characters and their probabilities. For example, if the first character of a password is aa, then PASS GPT will generate the second character based on the probability distribution of all possible characters that can follow A in a password. This way, PASS GPT can create passwords that are more diverse and unpredictable than other models that generate passwords as a whole. Another advantage of PASS GPT is that it surpasses generative adversarial networks JANs, which are another type of AI models that can generate passwords. JANs consist of two competing a generator that creates new passwords and a discriminator that evaluates them for authenticity. The generator tries to fool the discriminator by creating realistic passwords, while the discriminator tries to distinguish between real and fake passwords. However, gns have some limitations when it comes to password generation. For one thing, they require a lot of computational resources and training time to achieve good results. For another thing, they do not provide a clear measure of how likely a password is to be guessed by an attacker. This is because GANs do not assign probabilities to the generated passwords they only classify them as real or fake. PASS GPT solves these problems by using log likelihood as a measure of password strength. Log likelihood is a mathematical concept that indicates how probable a password is given a certain model. The higher the log likelihood of a password, the more likely it is to be generated by the model. Conversely, the lower the log likelihood of a password, the less likely it is to be generated by the model. By using log likelihood, PASS GPT can estimate how strong or weak a password is based on how common or rare it is in the training data. For example, A password like password 123 has a high log likelihood because it is very common and easy to guess. A password like qw3rti has a low log likelihood because it is very uncommon and hard to guess. PASS GPT can use this information to generate passwords that have low log likelihoods and high security. To demonstrate the power of passgpt. The researchers conducted several experiments to compare it with other models and methods of password generation and guessing. They found that PASS GPT outperformed all the other models in terms of generating passwords that were not seen in the training data, which means that they were novel and unique. They also found that PASS GPT was able to learn patterns in multiple languages such as English, Spanish, German, and French, and generate passwords that matched the linguistic features of each language. For example, PASS GPT generated passwords like amor 1234 for Spanish and liebe 1234 for German, which both mean love 1234 in English. Another interesting feature of PASS GPT is that it can perform guided password generation, which means that it can generate passwords based on some user defined criteria or constraints. For example, a user can specify the length, the characters, or the words that they want to include or exclude in their password. PASS GPT can then generate passwords that satisfy these requirements and still have low log likelihoods and high security. PASS GPT can also help improve password strength estimation, which is the process of evaluating how secure a password is against attacks. Password strength estimators are tools that can measure the entropy or randomness of a password and give feedback to users on how to improve their passwords. However, most password strength estimators are based on simple rules or heuristics that do not capture the complexity and diversity of real world passwords. Passgpt can provide a more accurate and reliable way of estimating password strength by using its log likelihood scores as a proxy for entropy. By comparing the log likelihoods of different passwords, PASS GPT can rank them according to their security level and give suggestions on how to make them stronger. For example, PASS GPT can tell that password123 is weaker than PSW0RD123, which is weaker than PGA5W0RD. One of the benefits of LLMs like Pass GPT is that they can be customized with different datasets for specific applications. For example, PASS GPT can be trained on passwords from a particular domain or industry, such as banking, healthcare, or education, and generate passwords that are relevant and appropriate for those sectors. This way, PASS GPT can cater to the needs and preferences of different users and organizations. PASS GPT has many potential applications and implications for various sectors and scenarios. For example, it can be used by individuals to create and manage their own passwords for their online accounts and devices. PASS GPT can also be used by organizations to generate and store passwords for their employees and customers. It can also be used by researchers and security experts to analyze and test the security of existing passwords and systems. However, Pass GPT also poses some challenges and risks that need to be addressed and mitigated. For one thing, Pass GPT could be used by malicious actors to launch more sophisticated and effective attacks against passwords and systems. For another thing, it could raise some ethical and legal issues regarding the use of leaked passwords as training data. These issues need to be carefully considered and resolved before deploying it in real world settings. As you can see, Pass GPT is a groundbreaking technology that has the potential to change the way we create and use passwords online. It's a powerful tool that can help us improve our password security and protect our online identities. It's also a fascinating example of how AI and machine learning can learn from human behavior and generate new knowledge. But Pass GPT is not the end of the story. It's just the beginning of a new era of password modeling using LLMs. There are still many research directions and challenges to explore in this field, such as improving the efficiency and scalability of LLMs, enhancing the diversity and quality of generated passwords, incorporating user feedback and preferences into password generation, developing more robust and reliable password strength estimators, etc. I hope you enjoyed this video and learned something new about Pass GPT and password security. If you did, please give this video a thumbs up and share it with your friends. And don't forget to subscribe to my channel for more videos like this one. Also, let me know in the comments below what you think about past GPT and what other topics you want me to cover in future videos. Thank you for watching and see you in the next one.










