Testing metrics for password creation policies by attacking large sets of revealed passwords

Abstract

In this paper we attempt to determine the effectiveness of using entropy, as defined in NIST SP800-63, as a measurement of the security provided by various password creation policies. This is accomplished by modeling the success rate of current password cracking techniques against real user passwords. These data sets were collected from several different websites, the largest one containing over 32 million passwords. This focus on actual attack methodologies and real user passwords quite possibly makes this one of the largest studies on password security to date. In addition we examine what these results mean for standard password creation policies, such as minimum password length, and character set requirements.

A Birthday Present Every Eleven Wallets? The Security of Customer-Chosen Banking PINs

“…However, this is mathematically unsuited to measuring guessing difficulty 6 [14,9] and recently been confirmed experimentally to be a poor measure of cracking difficulty for human-chosen passwords [21]. A more sound measure is guesswork :…”

“…RockYou The leak of 32 million textual passwords from the social gaming website RockYou in 2009 has proved invaluable for password research [21]. We extracted all consecutive sequences of exactly 4 digits from the RockYou passwords.…”

“…Assuming that users with a blacklisted PIN will be re-distributed randomly according to the rest of the distribution (as assumed in [21]), the effects of blacklisting the top 100 PINs are substantial-λ 6 drops to 0.2%. Table 4.…”

A Research Agenda Acknowledging the Persistence of Passwords

“…Survey after survey finds that users ignore most security precautions, yet it seems implausible that two billion people would use the Internet if a majority suffered serious harm each year. The leak of 32 million RockYou user credentials [13] has not been linked to any visible surge in fraud (albeit, proving such direct links convincingly can be difficult). The reasons for this apparent lack of visible harm are poorly understood.…”

“…Infotheoretic entropy and the NIST criteria are poor measures [13] when users choose common passwords, e.g., 'Pa$$w0rd' isn't particularly strong. Strength is better measured relevant to a large population of passwords, as popularity is a main determinant of risk.…”