I was watching The Girl with the Dragon Tattoo, and Lisbeth Salander was really good at hacking computers as well as other security breaking skills, to the point where it was way too easy to do from a real life standpoint. This isn’t the first movie that’s treated hackers this way, showing them breaking stuff too easily, or going about it in a fantastic way.

Why do movies make hackers out to be geniuses, or show spectacular ways to hack computers?

  • are there any movies where the ha(c)rackers use realistic techniques and/or effort in their task?
    – matt_black
    Commented Jan 25, 2012 at 18:58
  • 5
    I'll answer that with asking you if there are any movies of police officers using realistic forensic techniques or of any movies about relationships that are realistic.
    – Tablemaker
    Commented Jan 25, 2012 at 20:10
  • There are some fairly accurate depictions of hacking in certain movies/tv, but most of it is an exercise of artistic license. A good example of both of these, is the Person of Interest episode, "Super". (S1-E11) There, one of the characters hacks into neighbors' Wi-Fi networks and hijacks their web cam feeds. While it's very possible to do this to one Wi-Fi network, it would be extremely difficult if not improbable to capture streams from multiple networks simultaneously on one system.
    – Iszi
    Commented Jan 25, 2012 at 21:18
  • 1
    @matt_black - I donno, "Swordfish" looked pretty realistic.
    – DVK
    Commented Jan 25, 2012 at 22:41
  • 1
    I remember seeing a movie where the hero types "hack" at the command prompt and is able to enter a secure system :) Commented Feb 9, 2012 at 15:51

10 Answers 10


First, movies are unrealistic in these regards. It's no different than the "realism" of zooming in on security cameras and cleaning up the images. It's just not realistic, but it makes for good entertainment and helps with plot advancement.

However, that said, there are plenty of people with easy-to-guess passwords. I know plenty of otherwise intelligent people who don't bother with good passwords, don't change them frequently, etc. Intelligence is no deterrent to bad password management, and therefore, super-villains and bad guys are just as likely to have easy-to-guess passwords.

If I were to try to crack into an account without brute force, I'd start with the basic easy-to-guess passwords, and count on the stupidity of the people I'm trying to hack. Or I'd resort to social engineering. "I'm from the helpdesk and I need to get rid of a virus on your PC. Can you give me your username and password so I can log in and do it?" (You'd be surprised how many people fall for this.)

An easy way to induce "willing suspension of disbelief" for the sake of password cracking in the movies, I tend to favor the "weak password" scenario as it's the most realistic.

  • 1
    That said, zooming in on security camera footage or random images is possible if the resolution of the recorded image exceeds that of the display. But once you exceed the available pixels extrapolation will only get you so far.
    – Xantec
    Commented Jan 25, 2012 at 16:23
  • 5
    True, but in my experience, most systems have a much lower resolution on the camera than your average PC display. Perhaps high-end ones, or military-grade cameras are a different story, but most commercial camera security systems just don't have that high a resolution. (We often have to try to read license plates from our systems where the cameras are less than 15 yards away and it's hard.) But our systems are around 5 years old. They could be better now.
    – David Stratton
    Commented Jan 25, 2012 at 16:26
  • And we're not even considering people using the same word for both their login and password...
    – Bertrand Moreau
    Commented Jan 25, 2012 at 17:26
  • 2
    Yeah, don't forget Enemy of the State where they rotate the security camera of a shop to gain a 3d modeling of a shopping bag and see if a bulge has changed. That was just great.
    – Napoleon Wilson
    Commented Jan 25, 2012 at 18:18
  • There was a scene in "Clear And Present Danger" where this guy was given mounds of papers to go through in an attempt to figure out the password for some drug cartel's disk files. Harrison Ford and this other guy were walking away, thinking it would take weeks or months, but were called back by the guy who got the code - using the digits of the guy's birth year, his wife's birth month and his daughter's birth day... in reverse. Commented Jan 26, 2012 at 16:03

Pretty much all the hacking techniques in the Girl With The Dragon Tattoo are real and used regularly by not only the bad guys, but also law enforcement, penetration testing teams, and security auditors.

Sure, Hollywood dramatises them, but in this case, not by much. I have managed teams of individuals who can do the things shown in this film, and in my dim and distant past, I did some of them myself.

Have a look at this question on Password Strength for some useful information on password strength, and why humans are so bad at making strong ones.

Regarding video feeds from CCTV cameras, there are now a few companies with systems that pull information from multiple frames to interpolate/extrapolate high quality stills. But no, you can't turn the view round to face the opposite direction the camera was facing (Enemy of the State). And you can't zoom in and pan indefinitely (Blade Runner)

A really good example of real techniques used today by attack groups is given by the Mr Robot series. If we exclude the psychotic/hallucinogenic plot themes, all the hacking, intrusion and exploitation carried out by the hackers are real.

  • 2
    After that comic, I'm sure one of the passwords every cracker checks first will be "correct horse battery staple" :-)
    – celtschk
    Commented Aug 24, 2012 at 14:04

In almost every computer security paradigm the weakest link is the human portion. Some security algorithms are just plain bad which helps hackers. Social engineering and stupidity go a long way toward making hackers look really good before suspension-of-disbelief is required too.

Here is an interesting calculator that gives you a rough idea of different computing power scenarios and how long a brute-force attack would take.

Using a password like "power" you get a result of less than a millionth of a second with an array of computers designed for brute-force and a worst-case online attack time frame of less than 4 hours. On the other hand a password like "1We^gold" gives a simulated attack time of 1.12 minutes with the same super-computer, but over two thousand centuries using an online dictionary based attack.

All that to say, on one hand ANY password that doesn't lock out guesses can be brute-forced on a long enough timeline or with enough computing power. The Hollywood question then becomes, is it easier to convince the audience that the password was weak or that the hacker has access to a super-computing array? The second option would be nice for a change, but usually the issue is either just ignored or explained by the target's weakness.


Well, about cracking, some notes:

  1. Is illegal in USA, so most are rogue or simply are not working in a different thing. The exceptions are government agents.
  2. In some movies, it show that the FBI and CIA has a team of expert in cracking. Of course it is stupid, first the FBI and CIA agent earn a average salary while a computer expert can earn the double with less than the effort. Second, it is not easy to work for the FBI and CIA, exist several requirements and every agent in controlled and audited regularly, so i don't think that nobody would want to work in the CIA instead of a big corporation. And finally, most of the work is outsourced...
  3. Since 2. some programs and services features a backdoor. In fact, most services are required to have a backdoor in case of an investigation. So it makes easiest to crack into some system.
  4. Exist systems with vulnerabilities that everybody (that know about it) can exploit. For example, it is pretty easy to hack into a Windows system (with physical access) using some hacking program (such CIA COMMANDER <-- lol ).
  5. Also, is the fact that most people uses the same password more of one time. So it is possible to collect the password from one site (for example a site of warez) and use the same password for break the email account.
  • Another point: Many sites allow to set a new password by having the site send you a confirmation email, under the assumption that only you can read your email. Thus as soon as someone can access your email account, he can break into all accounts with such a password protection scheme.
    – celtschk
    Commented Aug 24, 2012 at 14:01

Because, it is boring to show hackers as engineers. They didn't show Zuckerberg as a person that like build things - same logic here. I would consider her as Script kiddie, though.


Your question raises a lot of Network Security arguments, but i'll try to explain you the essential starting from the beginning.

1) All hacking movies and books are very unrealistic so a hacker stereotype is someone who usually does everything someone asks, even breaking NSA (Nations Security Agency) systems, that is quite impossible.

2) There are a lot of ways to hack someone's computer, not just guessing the password (if there's a password based authentication protocol) by using brute-force attacks (that take very much if the passwords are long and pretty random) or social engineering. There are a lot of other possible attacks if there's a weak protocol:

  • Passive attacks where the hacker can just listen the communication channel when somebody logs in and if the password is transmitted in clear (no cryptography) then everything's done: no brute force.
  • Active attacks where the hacker just need to change some transmitted bits or to interact with the victim without knowing anything to have the credentials/keys/passwords/passphrase.

Remember, the movie hacker is a stereotype that's able to do EVERYTHING, even that in real life is not so easy, sometimes not possible at all.


The don't always, What about Clear and Present Danger:

"In the movie, CIA computer whiz Petey (Greg Germann) cracks the password of the boat victim by manually guessing combinations of birthday numbers of the victim's family. " - IMDB

He later says something about having to write a program to crack a different account of someone with a better/higher CIA account (Ritter's I think)

  • Heh - I made a comment about this exact scene on the top answer. Commented Jan 26, 2012 at 16:05
  • 1
    I think I got there before you ;) Great scene, I think one of the guys says something like "We really need to change your password" as they're walking away!
    – AidanO
    Commented Jan 26, 2012 at 16:16

My answer has to do with the personality of most people who take up such skills. Introverts.

Introverts, tend to score higher on IQ test, because their personality is a better fit for thinking and abstract problems. They actually enjoy these types of activities. It makes them feel good. It motivates them. She seams to be a classic introvert type personality, as do most hacker characters in movies. Speaking for my self, I know that I can spend 20 hours a day learning about how different things work.

As far as how easy it is to hack stuff, well it depends on how well you have prepared/practiced. What you see in the movie is a person, you don't see the 3 years she might have spent writing programs, building networks and testing her skills. It seams to me like she was not really working before the movie and did what ever she liked. She might have 10 years experience in cracking systems. She might not be actually cracking the system in the movie mearly gaining access through a back door she spent 6 months putting in place.

If you want to understand how easy it can be to gain access, their are software tools that you can download for free right now. That have sets of attacks pre-loaded to crack certain types of software. Even a moderately knowledgeable person would be able to figure out how to use this software. A highly motivated person could do quite a lot with it.

The weakness in most security systems is the people who use them. If you know them well enough it is quite easy to gain access.


One simple way to look at this is hacking is so poorly understood by the general population that hackers are viewed as either the boogeyman or a wizard. Regardless the act of hacking is pure black arts magic (in their mind), and films generally portray it as such.

This leads to all the nonsense you see on screen:


Power users become powerful by accumulating tools

The best answer really is "Hollywood magic": the blow-by-blow work of software design does not look exciting to an observer, and so filmmakers look for heavily-visual metaphors that they hope capture the essence, if not the true form, of the activity. Sometimes they succeed in capturing the dimensions that matter to their story in a way that is honest if not literally true, like in Swordfish. Other times, they produce something patently absurd and comically stupid, also like in Swordfish. I think there is probably not just one best way to present software work in movies, because storytelling aims and context matter so much.

But that is not the only reason hackers and programmers in fiction seem to wield so much power so easily.

In the real world, people who work in software for many years collect tools that help them accomplish common tasks faster, better, and more easily. Programmers rely on re-use and automation to amplify their productivity.

Consider: the first time I try to guess someone's password, I probably have to write a program from scratch that can generate every possibility, and then write another program that can take an individual guess and actually try it out, and then I have to wire them together.

The second time I try to guess someone's password, I can probably re-use the first program, and I might be able to re-use the second program if their account is in the same system as the first account.


The 50th time I want to crack someone's password, I run my CollectTargetPersonalInfo program, which scrapes Google & Facebook & LinkedIn & Instagram & Twitter to try to collect any public info about the target -- full name, birth date, immediate family names, etc -- which then generates a "target profile" that my PasswordGuesser program uses to prioritize different regions of the keyspace.


The 700th time I want to crack someone's password, I just send an email with their name to my PasswordCrackerBot, which runs in the cloud. It adds the name to a list of people it is researching and attempting to crack. When it finally succeeds or gets locked-out, it replies to my email with the results.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .