BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Throw Out the Alphabet: Token-Based Markov Chains fo
 r Password\n   Cracking\n   Tags: DEF CON Official Talk | Tool 🛠\n   Wh
 en: Saturday\, Aug 8\, 15:00 - 15:59 PDT\n   Where: LVCCW Level 1 Hall 3 1
 006 (Main Track 1) and DCTV-1 - [1]Map\n\n   Description:\n   Classical Ma
 rkov password generators work over the character alphabet:\n   hashcat's M
 arkov masks\, JtR's --markov\, OMEN\, even neural models like\n   PassGPT.
 \n\n   We change one thing: the alphabet. Train an n-gram Markov on RockYo
 u\,\n   but segment with GPT-2's 50k BPE tokenizer instead of characters. 
 The\n   distribution stays RockYou-derived\; only the units change. The\n 
   vocabulary captures structure characters can't: name fragments\, digit\n
    patterns\, symbol clusters from web-scale text.\n\n   Across 14 leak co
 rpora (RockYou\, LinkedIn\, Yahoo\, +11 more)\,\n   token-Markov beats OME
 N at fixed budgets on all 14\, at 10^8 and 10^9\,\n   with best66 rules on
  both sides. On enterprise passwords (8+ chars\, 3\n   of 4 classes)\, we 
 recover ~6x more than OMEN: 6.3% vs 1.1% at 10^8\,\n   12.3% vs 2.3% at 10
 ^9\; the lead holds ~2.8x with rules applied.\n   tokenov hits 10^9 candid
 ates in minutes on CPU\; OMEN takes hours\;\n   PassGPT needs days.\n\n   
 Why: the tokenizer bakes in mixed-case\, digit\, and symbol primitives\,\n
    so multi-class compliance is modal\, not rare. "Michael99" is two\n   t
 okens\, not eight transitions.\n\n   We release tokenov: train an n-gram m
 odel with any tokenizer\, or use\n   include custom GTP-2 tokenizer. Pipe 
 into hashcat\, JtR\, or write to\n   disk. Use OSINT derived lists to seed
  generation customized to the\n   target. No GPU needed: 1B candidates in 
 under 2 minutes on an i9.\n\n     * Narayanan & Shmatikov\, "Fast dictiona
 ry attacks on passwords using\n       time-space tradeoff\," CCS 2005. (Ma
 rkov password modeling\,\n       original.)\n\n     * Weir et al.\, "Passw
 ord cracking using probabilistic context-free\n       grammars\," IEEE S&P
  2009. (PCFG\, the natural rival to Markov.)\n\n     * Durmuth et al.\, "O
 MEN: Faster password guessing using an ordered\n       Markov enumerator\,
 " ESSoS 2015. (The level-ordered enumerator we\n       benchmark against.)
 \n\n     * Melicher et al.\, "Fast\, lean\, and accurate: Modeling passwor
 d\n       guessability using neural networks\," USENIX Security 2016. (FLA
 \,\n       the neural baseline.)\n\n     * Hitaj et al.\, "PassGAN: A deep
  learning approach for password\n       guessing\," ACNS 2019.\n\n     * R
 ando et al.\, "PassGPT: Password modeling and (guided) generation\n       
 with LLMs\," ESORICS 2023. (Closest prior work\; uses GPT-2\n       fine-t
 uned on RockYou. We outperform it.)\n\n     * Cracken (https://github.com/
 shmuelamar/cracken). The proximate\n       inspiration\; uses BPE for pass
 word masks. We extend the BPE idea\n       from masks to full Markov gener
 ation.\n\n     * MAYA benchmark (S&P 2026). The 19-corpus evaluation frame
 work we\n       adopted.\n\n   SpeakerBio:  Jon "flakpaket" Gorenflo\, ATT
 ACKD\n\n   Jon Gorenflo is the founder of ATTACKD\, a cybersecurity consul
 ting\n   firm dedicated to helping organizations of all sizes think like\n
    attackers and proactively secure their environments. Whether you're a\n
    startup\, a small business\, or a global enterprise\, Jon brings\n   re
 al-world offensive security insights that are practical\, accessible\,\n  
  and actionable. He is also a Principal Instructor with the SANS\n   Insti
 tute and the co-author of SEC560: Enterprise Penetration Testing\,\n   a l
 eading course on advanced ethical hacking and red team operations.\n   Wit
 h more than 20 years of combined experience in IT\, penetration\n   testin
 g\, incident response\, and security training\, Jon has worked with\n   a 
 diverse range of organizations to uncover critical vulnerabilities\n   and
  build resilient defenses. In addition\, Jon serves as the executive\n   d
 irector of Hackers Teaching Hackers (HTH)\, a grassroots cybersecurity\n  
  conference that emphasizes hands-on learning and community connection.\n 
   Jon is known for his clear communication\, relatable style\, and\n   ded
 ication to helping defenders build practical skills. He breaks down\n   ha
 cker tactics into understandable steps and helps teams of all sizes\,\n   
 from a solo IT admin to an enterprise SOC\, apply those lessons to\n   rea
 l-world defenses.\n\n   '\n\n   1. #LVCCW_Level1_Hall3\n\n\n
DTEND:20260808T225900Z
DTSTART:20260808T220000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1006 (Main Track 1) and DCTV-
 1
SUMMARY:Throw Out the Alphabet: Token-Based Markov Chains for Password Crac
 king
END:VEVENT
END:VCALENDAR