Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms

By Patrick Gage Kelley, Saranga Komanduri, Michelle L. Mazurek, Richard Shay, Timothy M. Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Julio C. López. IEEE Symposium on Security and Privacy, 2012

517 citations recorded by the source corpus.

Subfields: Applied Psychology, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b9a2c5e690ed6d83a860f03ba815094ca1e995c8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Applied Psychology

In Information Systems

In Signal Processing

Citations in the corpus

A Study of Probabilistic Password Models (2014, methodology): “8 for other scenarios, because of space limitation.”
Cyber-physical systems security: Limitations, issues and future trends (2020, unknown): “…crack their passwords using brute-force [169], dictionary [170] (mitigated by using key exchange [171]), rainbow table [172], birthday (mitigated by hashing) [173] or online/ofﬂine password guessing attacks [174] to gain access to the password database, or to the incoming/outgoing network trafﬁc.”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, methodology): “Although prior work has shown that password-composition policies requiring more characters or more character classes can improve resistance to automated guessing attacks, many passwords that meet common policies remain vulnerable [18,26,37,38].”
"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, background): “analyzed a set of 12,000 passwords collected from sites with different password strength and composition policies [26].”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, methodology): “This is particularly challenging in data-slicing experiments [8], [23] which require simulating an equally good dictionary attack against each subpopulation.”
PassGAN: A Deep Learning Approach for Password Guessing (2017, methodology): “so been used to implement real-time password strength estimators, and to evaluate the strength of passwords in plaintext databases (see, e.g., [14], [10]). Probabilistic context-free grammars (PCFGs) [32], [75] leverage manually-encoded information on passwords structure to generate new guesses. Thi”
The Tangled Web of Password Reuse (2014, background): “Here is an example policy: I. Passwords must not contain the user’s entire name/user ID.”
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (2016, methodology): “We compare our implementation of neural networks to stateof-the-art password-guessing models, including widely studied Markov models [65] and probabilistic contextfree grammars [59, 93], as well as software tools using mangled dictionary entries [74, 83].”
Honeywords: making password-cracking detectable (2013, background): “Attackers can then refine their models of user password selection and design faster password cracking algorithms [23].”
Guessing human-chosen secrets (2012, methodology): “H1 has further been claimed to poorly predict actual password-cracking times [309, 168], though these studies used naive estimates of H1 which aren’t accurate (§5.”