Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms

Abstract

Text-based passwords remain the dominant authentication method in computer systems, despite significant advancement in attackers' capabilities to perform password cracking. In response to this threat, password composition policies have grown increasingly complex. However, there is insufficient research defining metrics to characterize password strength and evaluating password-composition policies using these metrics. In this paper, we describe an analysis of 12,000 passwords collected under seven composition policies via an online study. We develop an efficient distributed method for calculating how effectively several heuristic password-guessing algorithms guess passwords. Leveraging this method, we investigate (a) the resistance of passwords created under different conditions to password guessing; (b) the performance of guessing algorithms under different training sets; (c) the relationship between passwords explicitly created under a given composition policy and other passwords that happen to meet the same requirements; and (d) the relationship between guessability, as measured with password-cracking algorithms, and entropy estimates. We believe our findings advance understanding of both password-composition policies and metrics for quantifying password security.

On the Privacy Impacts of Publicly Leaked Password Databases

“…Some works try to assess or measure the strength of a password [6,15,24,1,2,13,7]. In this context, password meters are supposed to help users to improve their password.…”

“…These last few years, research focused on password user studies [5,25,1], password breaking [26,18] and estimation of password strength [6,15,24,1,2,13,3]. Most existing attacks apply to passwords that are used by an important number of users.…”

Enhancing Security in user authentication through honeyword

“…Generally user chooses password which are simple and easy to remember. [8] [9] Such type of password can easily identify using some basic attacks. [10] [11] [12] System allow user to select password which consist of minimum 8 characters, one digit and one special symbol is implemented.…”

Authentication Schemes - Comparison and Effective Password Spaces

“…Yet, these are not applicable in many scenarios as such passwords are usually more difficult to remember. Assessing the effective password space can be difficult, because a sufficiently large sample of passwords is needed to derive any meaningful information on frequently appearing values [21]. Multiple metrics have been proposed to compare and predict the password spaces of different schemes.…”

“…However, it has been found, that neither the NIST estimates nor Shannon entropy provide truely reliable estimates and represent more a "rule of thumb" than an accurate metric, especially since sample sizes in typical usability studies are far smaller than what would be desirable [21,33]. Kelley et al [21] proposed guess-number calculator and Bonneau [2] proposed α-guesswork as more robust and reliable metrics, but for none of these two empirical values for graphical passwords are available. Thus, in the the absence of viable alternatives, Shannon entropy is used as measure to configure the schemes in this study.…”