I was pointed in the direction of a blog posting talking about the use of GPU processors to launch brute-force attacks on passwords. GPUs are extremely good at this sort of workload, and the price/performance ratio has changed dramatically over the past few years. What might have seemed impossible even 36 months ago is now perfectly do-able on your desktop computer.

In this report, the author takes a fairly standard Radeon 5770 graphics card (you’ll find it on our A-List under Value Graphics Card), and uses a free tool called ighashgpu to run the brute-force password cracking tools on the GPU. To provide a comparison point with the capabilities of a standard desktop CPU, he uses a tool called “Cain & Abel”.

The results are startling. Working against NTLM login passwords, a password of “fjR8n” can be broken on the CPU in 24 seconds, at a rate of 9.8 million password guesses per second. On the GPU, it takes less than a second at a rate of 3.3 billion passwords per second.

Increase the password to 6 characters (pYDbL6), and the CPU takes 1 hour 30 minutes versus only four seconds on the GPU. Go further to 7 characters (fh0GH5h), and the CPU would grind along for 4 days, versus a frankly worrying 17 minutes 30 seconds for the GPU.

Is an IT manager really going to manage to get the CFO to log in using “fR4; $sYu 29 @QwmQz” without the combination ending up on a Post-it note in his wallet?

Now, I cannot imagine anyone managing to mandate a nine-character, mixed-case, random-character password on an organisation. But if you did, and you weren’t hanging from a tree by the end of the first working day, the CPU would take 43 years versus 48 days for the GPU.

He then went on to add in mixed symbols to create “F6&B is” (there is a space in there). CPU will take 75 days, GPU will take 7 hours.

What does this tell us? well, the stark reality is that even long and complex passwords are now toast. If you think you were being wise by forcing users to have randomisation in their passwords, then think again. It is utterly futile.

Yes, you can force your users to have a 15-character password consisting of random numbers and letters, and throw in punctuation as well. This is great as an idea, but we know that most users think that a password like “Barry1943Manilow” where 1943 was the year he was born, is complex and hard to remember. Is an IT manager really going to manage to get the CFO to log in using “fR4; $sYu 29 @QwmQz” without the combination ending up on a Post-it note in his wallet? Or stuck to the side of the screen? Because anything much less than this is going to be open to attack over the next few years.

A GPU of the type used by this chap is not unusual or high end. It is standard-issue stuff. Indeed, I have just sat through the AMD presentation here at Computex in Taiwan, and they made a big deal about putting GPU power into netbooks offering 500Gflops, without denting its 12-hour battery life. And that’s shipping within months.

All I can say is this: you have been warned. It is time to think long and hard about password security, and how you do your authentication. This has crept up on us in the background, and we really haven’t been paying attention. Nor has Microsoft, frankly, who should be having a whole raft of alternative, hardened solutions in place ready for its business customers to roll out.

What are the solutions? To be honest, I’m not sure. A combination of TPM, biometrics, passwords and maybe something else entirely new will be needed. But it’s clear that a complex password that users will actually accept for day-to-day authentication, and keep secret, might be history.

The leaked information concerns the Radeon HD 6750 and HD 6770 which, if the past two generations are to be believed, will sit in the middle of the upcoming range. There’s evidence to suggest that the new series is more evolution than revolution, with both cards still using the 40nm fabrication process that was introduced way back with the HD 4770 and the GDDR5 memory that’s been commonplace for the past year.

Nevertheless, the list of specifications hints at the increased power that AMD has been able to eke out of its new Northern Islands family, of which the Barts XT core is the first representative. The HD 6750 will allegedly have a 725MHz core accompanied by 1,120 stream processors, and its compute performance of 1.624TFlops sits between the HD 5770 and HD 5850 in the pecking order.

The HD 6770 is, potentially, more interesting. Its alleged compute performance of 2.304TFlops is higher than the 2.088TFlops performance of the HD 5850 and, with 1,280 stream processors on board, it’s sure to pack some serious muscle.

The HD 6770 even manages to beat the HD 5870 in a couple of areas, with a higher clock speed – 900MHz to 850MHz – and a higher pixel fillrate, with the HD 6770 managing 28.8GPixel/sec to the 27.2GPixel/sec of the older card. Its GDDR5 memory is even clocked 50MHz higher than the HD 5870.

So, on paper – and assuming this leak is accurate – the HD 6770 is likely to outpace the HD 5850, which is already faster than anything Nvidia can offer at that price, and could even serve up performance that approaches the HD 5870. And, if AMD’s prices will remain in the same ballpark, the HD 6770 will cost around £110 exc VAT; the HD 5850, meanwhile, cost around £170 exc VAT on release, with the HD 5870 north of £200 exc VAT.

Of course, this is pure speculation, but there’s no reason to doubt that AMD’s recent form will carry over into its new generation of cards, even if there’s little revolutionary about the architecture behind these parts. Nvidia, meanwhile, is still filling out the bottom end of its GTX 400-series of GeForce products with cards like the GTS 450, and looks to have little in the way of an answer, with rumoured price cuts the only feasible short-term option.

Nvidia has recently lost its majority share in the desktop graphics market to AMD, and it looks like this gap is set to widen. No wonder Nvidia’s concentrating on Tegra and mobile these days.

Put simply, Nvidia’s desktop department is having a torrid time of it right now: when its own chipsets aren’t faulty they’re generally slower than ATI’s; and when they’re not faulty or slower than ATI’s, they are dearer, which negates any advantage they might have had.

It’s a cyclical thing. ATI had its troubled times before the HD 3000 cards arrived, and when new technology arrives the situation may well reverse again. But for evidence of where the strength lies you should alway look to the board partners – and it’s a one-way surge right now.

Today sees the news that XFX, as green as they come, has signed a deal to also ship ATI cards. And the gushing comments we’ve read accompanying the news leave us in no doubt as to who the partners are currently cosying up to. XFX’s defection follows Nvidia stalwarts eVGA and Gainward, and leaves the two graphics card manufacturers about level for exclusive partners, with a mere handful each.

In these credit-crunched times it may also be simply a case of getting cards to as many consumers as possible, so it won’t be entirely down to Nvidia’s current predicament, but the rave reviews on the red side surely can’t have helped.

And Nvidia almost seems resigned to its current fate, diverting most of its recent energies into promoting the excellent integrated graphics chipset in the last MacBooks, as well as its Ion platform to bring that chip into netbooks.

But it’s graphics cards the company is best known for, and so much now rests on the next major progression in the GeForce range. Whether Nvidia actually has something close to completion, and whether it’ll be enough to fight back, remain to be seen.

Gone will be the 8000 and 9000 number schemes, with things going back to (kind of) the beginning. So we’ll see 100s and 200s, and all the divisions of ten in between; while the suffix letters will find their way to the beginning of the names, a la G100 and GT140.

Because that’s simple.

Perhaps I’m just being picky on a Friday afternoon, but surely I’m not alone in thinking simple would have been to do away with the ghastly prefix/suffix convention altogether, in an entirely fresh start. Can anyone even remember why a GT was decided to be faster than a GS, which in turn is faster than a G, in the first place?

If memory serves, it has something to do with performance cars (yawn), but it bears so little relevance to a graphics card that it now merely serves to confuse everyone – including us reviewers. Is a 9800 GS faster than a 9600 GT? By the suffix convention it surely should be, but by the number scheme it shouldn’t. And what the hell is a GTS when it’s at home?

ATI managed it pretty well by switching to its HD naming scheme: with the first three digits representing the series, family and iteration respectfully (i.e. HD 4870 is the 4-series, high-end 8 family, and the upper 70 rather than the mainstream 50). It’s not perfect, but it means you know instantly where a card sits in the grand scheme of things – an HD 4850 is clearly faster than an HD 4670.

But from what we’re hearing we’re stuck with those Nvidia prefixes for the forseeable future, and with ATI currently holding it down and giving it a Chinese burn in the graphics card wars, we can’t help but think that’s an opportunity for progress that the green team has missed.