The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords

By Joseph Bonneau. 2012

817 citations recorded by the source corpus.

Subfields: Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

Giving State to the Stateless: Augmenting Trustworthy Computation with Ledgers (2019, background): “This creates a tension between the requirement to support easily memorable passwords (such as device PINs) while simultaneously preventing attackers from simply guessing users’ relatively weak passwords [18], [61].”
The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes (2012, background): “Our ratings are useful and we stand by them, but they are not a substitute for independent critical analysis or for considering aspects we didn’t rate, such as vulnerability to active man-in-the-middle attacks.”
A Study of Probabilistic Password Models (2014, background): “8 for other scenarios, because of space limitation.”
The Tangled Web of Password Reuse (2014, methodology): “Here is an example policy: I. Passwords must not contain the user’s entire name/user ID.”
Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment (2015, background): “, jDpwj 10(6) [43], and it follows that A can complete the above attack in seconds on a common PC.”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, neutral): “[9], Bonneau [3], and Castelluccia et al.”
Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound (2018, background): “It is natural for us to approximate D by using real-life password accounts with frequency; As A is clever, when performing an online guessing, she would always try the most likely password candidate first [33],”
Zipf’s Law in Passwords (2017, neutral): “1Almost at the same time, Bonneau [20] employed essentially the same approach with [19] and as expected, the same conclusion with [19] was reached.”
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (2016, methodology): “The first relies on purely statistical methods, such as Shannon entropy or other advanced statistical approaches [21, 22].”
Differentially private anonymized histograms (2019, background): “Password frequency lists: Anonymized password histograms are useful to security researchers who wish to understand the underlying password distribution in order to estimate the security risks or evaluate various password defenses [7, 6].”
A Security Analysis of Honeywords (2018, neutral): “To our knowledge, existing works [9], [13], [19] mainly consider trawling guessing attackers (see [5], [22], [30]) who exploit only users’ behavior of choosing popular passwords.”
Honeywords: making password-cracking detectable (2013, background): “Based on study of published password corpora, including one for 70 million Yahoo! users, he estimates that a majority of passwords have little more than 20 bits of effective entropy against an optimal attacker [7, 8].”
Targeted Online Password Guessing: An Underestimated Threat (2016, methodology): “Interest-ingly, in most of our experiments, we ﬁnd that for every of the eight real-world algorithms (i.e., excluding the trawling optimal one [5]), the ratio of the number of successfully cracked accounts f n to the guess number per account n can be well approximated by a power law: f n = C (cid”