Of passwords and people: measuring the effect of password-composition policies

472 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Differentially Private Password Frequency Lists (2016, background): “Several empirical studies have shown that these password composition policies frustrate users and result in more forgotten passwords [24], [15] and may sometimes even cause users to select weaker passwords [23], [3].”
"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, background): “Other work has investigated the effect of strength meters on password creation [15, 30, 49].”
The Tangled Web of Password Reuse (2014, background): “Here is an example policy: I. Passwords must not contain the user’s entire name/user ID.”
Zipf’s Law in Passwords (2017, unknown): “, [10], [11]) have often employed these automated software tools to conduct dictionary attacks as a secondary goal.”
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, unknown): “We also summarize participant demographics.”
Guessing human-chosen secrets (2012, methodology): “In small-scale studies, users may be willing to share passwords with researchers under ethics oversight [173, 169].”