If words have nothing to do with it then I am not sure how your link shows that Markov Chains are better at memorizing, because a Markov Chain over characters would do a much worse job at generating coherent text.
But I actually acknowledged your second point, so I never said that RNNs are useful for password guessing, unless maybe you have a very expensive hash function. However, they are good at memorizing sequences and log-likelihood is not an irrelevant measure of performance on passwords. It measures ability of the model to generalize to unseen data. In this case that means generating realistic passwords that are not in the training data. That is important because otherwise you might as well just use a dictionary attack.
> If words have nothing to do with it then I am not sure how your link shows that Markov Chains are better at memorizing, because a Markov Chain over characters would do a much worse job at generating coherent text.
Over n-grams, it would not, as some of the responses to Karpathy's post noted, by posting Markov chain text which is of high quality. The char-RNN shows its greatest ability in matching syntax and recusive structures and in modeling the subtler aspects of English grammar, syntax, and semantics... which are all useless in password guessing. (For example, I could only tell the difference between the Markov chain and char-RNN C source, because the char-RNN understood the nesting of syntax, but not between the Shakespeare.)
> However, they are good at memorizing sequences and log-likelihood is not an irrelevant measure of performance on passwords. It measures ability of the model to generalize to unseen data.
No, it measures a particular loss function proportional to the mean log probability. In password guessing, the loss function is zero-one: you care only about guessing a single exactly right password. You get zero points for generating a realistic password which is one character off. Being able to model the distribution of 'e's slightly better is irrelevant compared to being able to memorize common birthday suffixes and guess a few more passwords per second. Having a better log likelihood on a natural English language corpus is measuring the wrong thing on the wrong data.
> you might as well just use a dictionary attack.
Exactly. This is how the best password crackers work: mix-and-match memorized literals, prefixes, and suffixes extracted from dumps of billions of passwords. A Markov chain is a souped-up dictionary attack demonstrating 'The unreasonable effectiveness of big data'.
But I actually acknowledged your second point, so I never said that RNNs are useful for password guessing, unless maybe you have a very expensive hash function. However, they are good at memorizing sequences and log-likelihood is not an irrelevant measure of performance on passwords. It measures ability of the model to generalize to unseen data. In this case that means generating realistic passwords that are not in the training data. That is important because otherwise you might as well just use a dictionary attack.