I don't know, when I run a password cracker, I always start with a brute force pass of very short passwords. Doing so adds a negligible amount of time to the crack, and its surprising how many short passwords you'll find in systems that permit them.
I was a little surprised when a well-known password cracker managed to pop a bunch of passwords set by a sysadmin at a place I used to work at, who had left under something of a cloud.
I wouldn't have got them if I hadn't set it to start at three characters, on a hunch.
Cameron, if you're out there, I hope you're making less of an arse of it and not still using "CAM" as a password for everything.
