Testing metrics for password creation policies by attacking large sets of revealed passwords

By Matt Weir, Sudhir Aggarwal, Michael P. Collins, Henry Stern. Conference on Computer and Communications Security, 2010

468 citations recorded by the source corpus.

Subfields: Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/9697cbd92c9d77002042ebdba46cd93ca520ffff

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

Optimizing password composition policies (2013, background): “When hackers leaked the RockYou dataset to the Internet, both researchers (and attackers) suddenly had access to password data, leading to many insights into true passwords [Weir et al. 2010].”
A Study of Probabilistic Password Models (2014, methodology): “We use PCFGW to denote this password model.”
Guessing human-chosen secrets (2012, methodology): “H1 has further been claimed to poorly predict actual password-cracking times [309, 168], though these studies used naive estimates of H1 which aren’t accurate (§5.”
Of passwords and people: measuring the effect of password-composition policies (2011, background): “suggest that entropy by itself might not be the best metric for evaluating the security of a given password [21].”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, background): “So far, large-scale password data has arisen only from security breaches such as the leak of 32 M passwords from the gaming website RockYou in 2009 [7], [8].”
Zipf’s Law in Passwords (2017, unknown): “, [10], [11]) have often employed these automated software tools to conduct dictionary attacks as a secondary goal.”
A Research Agenda Acknowledging the Persistence of Passwords (2012, background): “In the absence of a silver bullet the messy work of trade-offs cannot be escaped.”
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, methodology): “divide a large set of existing passwords into different categories based on composition, then apply automated cracking tools to examine how well NIST’s entropy estimates predict measured guessing difficulty [13].”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, methodology): “Although prior work has shown that password-composition policies requiring more characters or more character classes can improve resistance to automated guessing attacks, many passwords that meet common policies remain vulnerable [18,26,37,38].”
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (2016, background): “A common way to evaluate the strength of a password is by running or simulating password-guessing techniques [35,59,92].”