oops! Winzip passwords

[age]

I have forgotten my password to a winzip folder with a lot of important work in it. I have to have it in winzip to carry it around. Is there any way around the password system?

[lisaj]

That depends - you can brute force crack the Zip file easily and if you're someone who chooses easy passwords (like a word, or a word with some numbers thrown in) then it won't take long. If, on the other hand, you're someone who understands computer security and you use complex passwords, it'll take much longer...

[hertz]

Try using a Password Recovery program, such as http://www.zipcure.com/index.html. This is shareware, and it uses the "brute force" mthod that Lisaj mentioned.

[hertz]

Sorry - I shouldn't have put a fullstop after the URL. Try again http://www.zipcure.com/index.html

[lisaj]

btw, "much longer" means MUCH longer. My main windows password would take around 17.5 million years to brute force at a rate of 1,000,000 tries/sec. And that's only 11 characters. I hope for your sake that you don't choose good passwords :-)

[SavageMonkey]

You know lisaj, I didn't believe you with those statistics. Then I wacked this equation in to google: (((((200^11) / 1 000 000) / 60) / 60) / 24) / 365

And man, it REALLY does take that long. But also, can many brute force password crackers do it at 1,000,000 tries per second?

[lisaj]

well, brute forcing depends on how the system that is locked works. With ZIP files, they're encrpyted in a very particular and known way, so it's highly likely that the process can be reduced using some known weaknesses. For example, if you knew that the system you were trying to break held MD5 hashes of the passwords, you could try breaking it with lists of known hashes rather than creating hashes on the fly: this is because string comparisons are far more efficient than hash generations. You get the idea anyway.... Oh, and there are 94 characters combinations... so it'd be 94^11, not 200^11(lowercase+uppercase+numeral+grammar).