Password Strength: An Empirical Analysis

By Matteo Dell'Amico, Pietro Michiardi, Yves Roudier. 2010 Proceedings IEEE INFOCOM, 2010

315 citations recorded by the source corpus.

It is a well known fact that user-chosen passwords are somewhat predictable: by using tools such as dictionaries or probabilistic models, attackers and password recovery tools can drastically reduce the number of attempts needed to guess a password. Quite surprisingly, however, existing literature does not provide a satisfying answer to the following question: given a number of guesses, what is the probability that a state-of-the-art attacker will be able to break a password? To answer the former question, we compare and evaluate the effectiveness of currently known attacks using various datasets of known passwords. We find that a "diminishing returns" principle applies: in the absence of an enforced password strength policy, weak passwords are common; on the other hand, as the attack goes on, the probability that a guess will succeed decreases by orders of magnitude. Even extremely powerful attackers won't be able to guess a substantial percentage of the passwords. The result of this work will help in evaluating the security of authentication means based on user- chosen passwords, and our methodology for estimating password strength can be used as a basis for creating more effective proactive password checkers for users and security auditing tools for administrators.

Subfields: Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/fa6edcf9feaa6dbdeaa0ace5212fd5fadc5c7f72

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

A Study of Probabilistic Password Models (2014, methodology): “[9] compared the cracking effectiveness of Markov models on the “Italian”, “Finnish”, and “MySpace” datasets by computing the estimated probabilities for each password in the datasets and using an approximation algorithm to compute the number of guesses for each threshold.”
The Tangled Web of Password Reuse (2014, result): “That said, many of our data sets have been used in prior scientific studies [23], [29], [34], [47], [48].”
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, background): “We investigate the effectiveness of entropy as a measure of password guessability.”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, background): “, who studied the MySpace passwords as well as those of two other websites using a large variety of different dictionaries [7].”
Guessing human-chosen secrets (2012, background): “, who studied the MySpace passwords as well as those of two other websites using a large variety of different dictionaries [81].”
Zipf’s Law in Passwords (2017, unknown): “extreme case, if the attacker has also obtained the entire password dataset in plain-text and thus, she can obtain the right order of the passwords, this attack is called an optimal attack [20], [26].”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, background): “We neither further propagate the data, nor does our work call significantly greater attention to the data sets, which have been used in several scientific studies [4, 9, 18, 38, 39].”
PassGAN: A Deep Learning Approach for Password Guessing (2017, background): “Unfortunately, multiple password database leaks have shown that users tend to choose easy-to-guess passwords [15, 20, 49], primarily composed of common strings (e.”
Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment (2015, background): “However, if the parameter Ai is computed as Ai = h(~(IDi)⊕~(PWi)), it is not difficult to check that there exist |Did|∗|Dpw| 28 ≈ 2 32 candidates of (ID, PW ) pair to thwart A when |Did| = |Dpw| = 10(6) [54], [55], where ~(·) is a special one-way hash function {0, 1}∗ → {0, 1, .”
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (2016, background): “A common way to evaluate the strength of a password is by running or simulating password-guessing techniques [35,59,92].”