Optimizing password composition policies

By Jeremiah Blocki, Saranga Komanduri, Ariel D. Procaccia, Or Sheffet. 2013

32 citations recorded by the source corpus.

A password composition policy restricts the space of allowable passwords to eliminate weak passwords that are vulnerable to statistical guessing attacks. Usability studies have demonstrated that existing password composition policies can sometimes result in weaker password distributions; hence a more principled approach is needed. We introduce the first theoretical model for optimizing password composition policies. We study the computational and sample complexity of this problem under different assumptions on the structure of policies and on users' preferences over passwords. Our main positive result is an algorithm that -- with high probability --- constructs almost optimal policies (which are specified as a union of subsets of allowed passwords), and requires only a small number of samples of users' preferred passwords. We complement our theoretical results with simulations using a real-world dataset of 32 million passwords.

Subfields: Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

1. Jeremiah Blocki
2. Anupam Datta
3. Joseph Bonneau
4. Ananda Theertha Suresh
5. Ping Wang
6. Ding Wang

In Signal Processing

1. Jeremiah Blocki
2. Anupam Datta
3. Joseph Bonneau
4. Ping Wang
5. Ding Wang

Citations in the corpus

• Differentially Private Password Frequency Lists (2016, methodology): “Several empirical studies have shown that these password composition policies frustrate users and result in more forgotten passwords [24], [15] and may sometimes even cause users to select weaker passwords [23], [3].”