Could use some help cracking Chess password
UPDATE: our tech savvy friend got in without the password! I do appreciate all the chess help. According to Walter’s friend, he’d be laughing himself silly at our attempts to solve his chess riddle. We spent several hours arguing the finer points of the King’s Gambit, lol.
For those of y’all worrying how this was handled. Those were good concerns. My colleague is passing the files over to the executor of his estate. Written permission was obtained for this whole adventure. Hopefully they get to his family (or colleagues for posthumous publication). But if his will says to burn it all, metaphorically speaking, I’d hope an executor would honor that. Though I’m thankful Virgil’s didn’t!
In case you’ve not been following along, the original post is below. Cheers! ——————————————————
Our colleague in the Classics department recently died and his family is trying to guess the password to his laptop. He was a chess grandmaster (I am not, but I love the game anyways) and the password hint is KGA.
Which I'm guessing is King's Gambit Accepted?
Any ideas y'all can come up with would be helpful! This was his work laptop, not his personal computer and we suspect several of his unpublished essays are on there. We apparently get an unlimited number of guesses. We found a note that said "The Cunningham" which may or may not be relevant. He changed the admin password and encrypted the computer so our IT department is of no help.
Edit: as one poster pointed out, I am not sure if he is actually a chess grandmaster. We do know he loved the game a lot.
Posted Feb 15, 2023, 2:27 AM UTC · edited
The Cunningham Defence is a variation in the King's Gambit Accepted, it runs 1. e4 e5 2. f4 exf4 3. Nf3 Be7.
I would try all of the following:
exf4
e4e5f4exf4
e4e5f4exf4Nf3Be7
exf4Nf3Be7
It wouldn't surprise me if he used some string of chess moves like that as a password, since it means the password uses lowercase/uppercase/numbers, but he can easily remember it.
I never thought of that, but it's actually a pretty clever way of creating complex passwords that you are still able to remember.
edit:
I am aware of the limitations of using this 'system'. Using this across all platforms to manage 100+ passwords would be a very challenging if not not unworkable. And as pointed out, not very safe once the system is exposed. I just found it an interesting idea.
There is an xkcd about the relation between complexity of the password and ease to remember. The downside of a password consisting of 4 random words is that they can be easily identified by a person standing next to you watching you type. That's where this 'system' works. You could use this for one crucial password. While you type in your favorite line of the Caro-Kann 32 character password, the colleague watching over your shoulder will have a hard time registering what you just typed in.
Meh. It's "security through obscurity", the passwords are only complex if an attacker doesn't know your method for generating them. It's fine as a one off, but if you use this technique for multiple passwords and one of them is compromised, brute forcing any others generated this way is trivial.
Well it USED TO be . . .
Developer of Unix Ken Thompsons password (which went unsolved for 20+ years) p/q2-q4!a is d4 in descriptive, so don’t forget to try non-algebraic chess notation
If you have somebody watching you type, you have big problems with any password.
[deleted]
Absolute nonsense. You are aware there are quite a few words in the dictionary?
[deleted]
Then use 6 words or a larger "dictionary" to choose them from (look up how diceware works to begin with ...)
I appreciate the insight! If we can't figure it out, at least we can pass it along to the data recovery company if we get stuck hiring them.
Definitely tell them you suspect it might be chess moves, if they can just use the characters { NBKQRabcdefgh12345678+x } in brute force attempts that will cut the search space down a ton, if they generate a set of all possible chess move tokens and try out a bunch of combinations that would be even better.
Should also add in #, ?, ! just in case dear professor liked to annotate his lines.
It may also be worth trying these passwords in descriptive notation
Or that, but with move numbers. So like 1.e4e52.f4exf4 or 1e4e52f4exf4