“One has to conclude that it is no great matter for someone with access to a PDP-11 to test all lower-case alphabetic strings up to length five and, given access to the machine for, say, several weekends, to test all such strings up to six characters in length.”
Password Security: A Case History
Robert Morris
Ken Thompson
Bell Laboratories
Murray Hill, New Jersey 07974
April 3, 1978