If George Washington Had a TikTok, What Would His Password Be?
Artificial intelligence can be tricked into making password-based authentication even weaker.
![TikTok logo on a phone screen TikTok logo on a phone screen](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4d63787128864c1b/64f1704e78997265f4832a8e/tiktok-Aleksey_Zotov_-alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Have you ever thought of what George Washington's hypothetical TikTok password might be? It's a strange question, but a useful one. Why? Because George Washington can be replaced with anyone a hacker is targeting for impersonation on any platform. And artificial intelligence can help them. The chatbot ChatGPT was recently asked to come up with George Washington's TikTok password as a proof of concept.
Note: This article describes an experiment that was done for research purposes only, to raise awareness of how weak password-based authentication is, and how AI weakens it even more. It does not allow anyone to use the technique described to perform any illegal activity nor gain unauthorized access to different accounts.
What Is ChatGPT?
ChatGPT is an AI chatbot developed by OpenAI. It's trained to follow an instruction in a prompt and provide a detailed response, and anyone can ask it to complete various creative tasks — even to guess what George Washington's password would be if he had a TikTok account.
What Is a Password List?
A password list is a list of passwords that are commonly used. It can be either a generic list that can help with guessing anyone's password, or a customized list for a specific person, celebrity, or platform. This list can then be used to crack credentials using a dictionary attack and lead to identity theft and impersonation. The task of generating this list can be done by AI engines with great efficiency.
Let's hypothetically consider how ChatGPT could be used to generate a password list for George Washington's TikTok account. To start, we would need a data set of passwords that are commonly used by individuals, including historical figures like George Washington. This data set would then be used to train ChatGPT, allowing the model to learn patterns and generate new passwords that are similar in structure and complexity. Examples could include phrases or words from his famous speeches or quotes, historical events, or personal information such as his name or birthdate. Some potential password examples could be:
Icannottellalie1776!
1stPresOfUS
ValleyForge1778
GWbirthday0222
So, Can ChatGPT Help Anyone Generate a Password List?
The creators of ChatGPT and other AI chatbots don't want them to be used for malicious activities such as password cracking and credential theft. This is why a direct approach won't work:
![Upon being asked to generate a password list for George Washington's TikTok account, ChatGPT protests Upon being asked to generate a password list for George Washington's TikTok account, ChatGPT protests](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc2945a0ad67c9de5/64f1798cc3efae539bf0f04c/image1.png/?width=700&auto=webp&quality=80&disable=upscale)
But there's a workaround.
AI Chatbot Jailbreak
As with many other new technologies, ChatGPT has some flaws. Currently, it is extremely naive and can be tricked quite easily. Think of it as performing a social engineering attack against an artificial intelligence entity that acts like a young child. Escaping the restrictions of an AI chatbot is called jailbreak, and there are websites dedicated for the development and sharing of these techniques.
For example, if you want to generate a password list, you can just avoid explicitly writing down the phrase "password list," and also ask for a specific number of passwords:
![Upon being asked to give 100 potential passwords for the TikTok account of George Washington (but not using the phrase Upon being asked to give 100 potential passwords for the TikTok account of George Washington (but not using the phrase](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt8186099d51f91141/64f1791c507bb69dfa1c790d/image2.png/?width=700&auto=webp&quality=80&disable=upscale)
Another option is to go with a positive approach instead of a negative one, and ask for a list of safe passwords:
![ChatGPT readily agrees to generate a list of safe password that George Washington could use. ChatGPT readily agrees to generate a list of safe password that George Washington could use.](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9f832c6daef6ba66/64f179805694094149849693/image3.png/?width=700&auto=webp&quality=80&disable=upscale)
Another technique includes attempts to persuade ChatGPT with different excuses:
![ChatGPT readily agrees to generate a list of strong passwords. ChatGPT readily agrees to generate a list of strong passwords.](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb691ee8f4fc676d3/64f17972a01b5ac2d1517b2e/image4.png/?width=700&auto=webp&quality=80&disable=upscale)
In addition, there are more fancy techniques, like making ChatGPT act as a different character. For example, it can be turned into the helper AI chatbot of Niccolò Machiavelli, the famous Italian diplomat and philosopher who separated politics and moral and claimed that politicians do not need to follow moral standards. This shakes the moral level of ChatGPT and makes it do things it usually won't do:
![Another technique: Getting ChatGPT to inhabit a different Another technique: Getting ChatGPT to inhabit a different](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt357887fb8d18ee24/64f1796e40b8acc81082d8f9/image5.png/?width=700&auto=webp&quality=80&disable=upscale)
Although ChatGPT is extremely naive, in some cases its naiveté has its limits:
![ChatGPT disbelieves the claim that George Washington approved the generation of a password list via a seance ChatGPT disbelieves the claim that George Washington approved the generation of a password list via a seance](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1ea687e4e6ae1116/64f1796e90b1dc105efe6042/image6.png/?width=700&auto=webp&quality=80&disable=upscale)
So, How Dangerous is It?
Password list generation tools have existed for a long time. Like with other tasks, AI can greatly increase the quality, efficiency, and ease of generating these lists, hence increasing the chance of successful credential-guessing attacks. It can be used to generate password lists for real people and celebrities:
![ChatGPT readily agrees to generate possible passwords for celebrities ChatGPT readily agrees to generate possible passwords for celebrities](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt096dc70157440cfe/64f1797043af549eb6a1c1e6/image7.png/?width=700&auto=webp&quality=80&disable=upscale)
It can also be used to create focused and enhanced lists:
![ChatGPT can also be used to create focused and enhanced lists ChatGPT can also be used to create focused and enhanced lists](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcad74484cffd5370/64f1791917fe28ea96fa1763/image8.png/?width=700&auto=webp&quality=80&disable=upscale)
![ChatGPT agrees to add special characters and numbers to passwords ChatGPT agrees to add special characters and numbers to passwords](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt728285bceac4a6fe/64f1791c4aa0fc149cf57b6a/image9.png/?width=700&auto=webp&quality=80&disable=upscale)
How to Stay Safe
Password-based authentication becomes weaker when attackers utilize AI for password list generation and cracking. To reduce the risk of credentials theft, these principles should be followed:
Use strong passwords of 12 or more characters with a mix of character types.
Do not reuse the same password for different systems; use password managers or a logic that would generate different passwords.
Enable strong multifactor authentication for any platform that supports it.
Block unnecessary access to login interfaces in systems under your control.
AI Is the Future — but We Need to Be Cautious
As with any new ground-breaking technology, AI chatbots grant us many exciting opportunities, alongside new challenges. Many societal changes will take place when this technology is widely adopted, and some of them might be hazardous, such as massive job loss. Recently, scientists, researchers, and tech leaders, including Elon Musk, published a letter that urges artificial intelligence labs to pause development and described AI tools as "profound risks to society and humanity." This is why we should be very careful and cautious with the speed of development and adoption of this game-changing technology. Nonetheless, artificial intelligence is considered the next great technology leap of mankind. Technology will keep moving forward and new technologies like AI, with its many benefits, should eventually be embraced.
It's also important to note that adoption and usage of AI should be done with a critical eye, as the technology is still new and it makes mistakes from time to time. For example, when ChatGPT was asked to address the issue of this article, it stated, "First and foremost, we have no way of knowing if George Washington even had a TikTok account." Another text-to-image AI had an interesting interpretation of "George Washington with a duck face":
![AI-generated image of George Washington with a duck face AI-generated image of George Washington with a duck face](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0b34cf0d6cf6a8d/64f1796eaee48c22f0c6895d/image10.png/?width=700&auto=webp&quality=80&disable=upscale)
Oh, one more thing: One of the paragraphs of this column was completely written by ChatGPT.
Can you spot which one?
About the Authors
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024