Choosing the most effective word-mangling rules to use when performing a dictionary-based password cracking attack can be a difficult task. In this paper we discuss a new method that generates password structures in highest probability order. We first automatically create a probabilistic context-free grammar based upon a training set of previously disclosed passwords. This grammar then allows us to generate word-mangling rules, and from them, password guesses to be used in password cracking. We will also show that this approach seems to provide a more effective way to crack passwords as compared to traditional methods by testing our tools and techniques on real password sets. In one series of experiments, training on a set of disclosed passwords, our approach was able to crack 28% to 129% more passwords than John the Ripper, a publicly available standard password cracking program.

In this paper we attempt to determine the effectiveness of using entropy, as defined in NIST SP800-63, as a measurement of the security provided by various password creation policies. This is accomplished by modeling the success rate of current password cracking techniques against real user passwords. These data sets were collected from several different websites, the largest one containing over 32 million passwords. This focus on actual attack methodologies and real user passwords quite possibly makes this one of the largest studies on password security to date. In addition we examine what these results mean for standard password creation policies, such as minimum password length, and character set requirements.

No abstract

Introduction:A Hazard Definition and Classification Review conducted by the UN Office for Disaster Risk Reduction (UNDRR) and International Science Council (ISC) resulted in publication of Hazard Information Profiles (HIPs). The HIPs provide groundwork for developing a statistical framework enabling better understanding of the true burden of hazards globally. Furthermore, standardized data is critical for effective monitoring of the Sendai Framework, Sustainable Development Goals, and Paris Agreement on Climate Change.Following the publication of the HIPs, governments and National Statistical Offices (NSOs) have been encouraged to review their systems for classifying, monitoring and reporting on disaster risk reduction with the aim to gradually implement the HIPs in databases and reporting systems.The aim of the pilot is to provide statistical feedback on the applicability of the reviewed hazard classification and its HIPs.Method:The DRS pilot utilizes mixed-qualitative methods: Global stakeholder workshopsLiterature review to understand the gaps and good practiceUtilizing snowball methodology to cascade a survey to DRS international experts.Country-level expert focus-groups.In-country pilots (with Low, Middle, and High-income countries).Delphi Methodology with expert stakeholders to hone recommendationsResults:596 responses to the survey from across 38 countries and 90 papers were identified for literature review. Survey initially sent to 120 stakeholders, and snowball methodology increased survey reach, particularly to Global South colleagues. Expert stakeholder and country-level focus groups identified a series of good practices and recommendations enabling step-change towards a standardized global statistical framework. Delphi methodology to refine recommendations is underway.Conclusion:The DRS pilot has raised global awareness of the importance of using the HIPs in developing a robust statistical framework with usable disaster-related statistics. This will enable greater accuracy of data contributing to Sendai Framework targets A-D. Results of the pilot being used to inform the Office of National Statistics-UKHSA-Wellcome collaboration on developing Standards for Official Statistics on Climate-Health Interactions in Africa.