A lot of talk on AOL is about ‘owning’ screen names. There are people trying to ‘own’ every 3 character screen name. There is no attempt here to get through to newbies; this is merely an essay for intelligent people who also mock the quixotic idea of ‘brute forcing’ a screen name. This essay will discuss briefly just how many screen names there are, and then go in depth about just how hard it would really be to crack a screen name with a completely random password without an exploit.
When America Online first came out, subscribers could make screen names 3-10 characters in length, with that and no leading numbers being the only restrictions[1]. So, when America Online was first out, let’s figure[2] out just how many original screen names there were, with 36 possible characters (a-z, 0-9- screen names are not case sensitive).
10
å 36^x = 3,760,620,109,777,728- or about 3.8 quadrillion.
n=3
From that, we need to compensate for the fact you cannot create screen names that start with a number. To accomplish this, we need to take the number of possible 2-9 character screen names, multiply by 10 (0-9), and subtract it from that. We use 2-9, because there is 1 leading character for each, and there needs to be at least 2 more characters to satisfy the length requirement.
10 9
å 36^x - å 36^x * 10 = 2,716,003,412,617,248- or 2.7 quadrillion.
n=3 n=2
This number represents the real number of screen names that could originally be made.
Now, AOL has changed the maximum length to 16, so we can adjust for this.
16 15
å 36^x - å 36^x * 10 = 5,910,148,253,103,040,656,975,904
n=3 n=2
That’s 5.9 octillion possible screen names as of now.
With the same method, we can figure out how many of the coveted 3 character screen names can be made.
3 2
å 36^x - å36^x * 10 = 45,360
n=3 n=2
These are the screen names most of the cretins out there are trying to crack. And this leads into the main point of this, the passwords possible.
In the very first calculation we made, it’s likely most people were completely shocked by that huge number. A quadrillion is a number beyond a trillion, and just thinking about a trillion of anything can give you a headache. The numbers above are quite small next to the number of passwords there are.
First, let’s talk about AOL passwords. AOL passwords must be 4-8 characters in length, are not case sensitive, and allow a-z and 0-9, with no other limitations.
10
å 36^x = 3,760,620,109,731,072
n=4
This represents the number of passwords possible on an AOL screen name, not an AIM screen name. If you wanted to brute force just an AOL, it would take a horrendous amount of time. We’ll assume you have a fast computer and internet connection… which will let you crack AOL screen names at a rate of 100 tries per second.
3,760,620,109,731,072 divided by 100 tries per second = 1,195,760.87128 YEARS, 119 MILLENNIA.