The DOI matches its Crossref record; 39 of the 39 references it cites were found in a registry or an index.
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms
Abstract
Text-based passwords remain the dominant authentication method in computer systems, despite significant advancement in attackers' capabilities to perform password cracking. In response to this threat, password composition policies have grown increasingly complex. However, there is insufficient research defining metrics to characterize password strength and using them to evaluate password-composition policies. In this paper, we analyze 12,000 passwords collected under seven composition policies via an online study. We develop an efficient distributed method for calculating how effectively several heuristic password-guessing algorithms guess passwords. Leveraging this method, we investigate (a) the resistance of passwords created under different conditions to guessing, (b) the performance of guessing algorithms under different training sets, (c) the relationship between passwords explicitly created under a given composition policy and other passwords that happen to meet the same requirements, and (d) the relationship between guess ability, as measured with password-cracking algorithms, and entropy estimates. Our findings advance understanding of both password-composition policies and metrics for quantifying password security.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
A Mathematical Theory of Communication
Shannon, C. E. (1948) · Bell System Technical Journal · doi:10.1002/j.1538-7305.1948.tb01338.x · Cited by 88,486
MapReduce: simplified data processing on large clusters
Dean, J., & Ghemawat, S. (2008) · Communications of the ACM · doi:10.1145/1327452.1327492 · Cited by 18,476
Amazon's Mechanical Turk: A New Source of Inexpensive, Yet High-Quality, Data?
Buhrmester, M., Kwang, T., & Gosling, S. D. (2011) · Perspectives on Psychological Science · doi:10.1177/1745691610393980 · Cited by 9,996
White, T. (2009) · Cited by 2,800
Prediction and Entropy of Printed English
Shannon, C. E. (1951) · Bell System Technical Journal · doi:10.1002/j.1538-7305.1951.tb01366.x · Cited by 2,686
Crowdsourcing user studies with Mechanical Turk
Kittur, A., Chi, E. H., & Suh, B. (2008) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1357054.1357127 · Cited by 1,923
A large-scale study of web password habits
Florencio, D., & Herley, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242661 · Cited by 1,047
Who are the crowdworkers?: shifting demographics in mechanical turk
Ross, J., Irani, L., Silberman, M. S., Zaldivar, A., & Tomlinson, B. (2010) · CHI '10 Extended Abstracts on Human Factors in Computing Systems · doi:10.1145/1753846.1753873 · Cited by 1,004
Analysis of end user security behaviors
Stanton, J. M., Stam, K. R., Mastrangelo, P., & Jolton, J. (2005) · Computers & Security · doi:10.1016/j.cose.2004.07.001 · Cited by 665
What’s in a Name?: Evaluating Statistical Attacks on Personal Knowledge Questions
Bonneau, J., Just, M., & Matthews, G. (2010) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-14577-3_10 · Cited by 579
Password Cracking Using Probabilistic Context-Free Grammars
Weir, M., Aggarwal, S., Medeiros, B. D., & Glodek, B. (2009) · 2009 30th IEEE Symposium on Security and Privacy · doi:10.1109/sp.2009.8 · Cited by 524
Demographics of Mechanical Turk
Ipeirotis, P. G. (2010) · Faculty Digital Archive (New York University Florence) · Cited by 494
On User Choice in Graphical Password Schemes
Davis, D., Monrose, F., & Reiter, M. K. (2004) · Cited by 471
Massey, J. L. (2002) · Proceedings of 1994 IEEE International Symposium on Information Theory · doi:10.1109/isit.1994.394764 · Cited by 463 · cited 2×
“Massey connects entropy with password strength by demonstrating that entropy provides a lower bound on the expected number of guesses to find a text [41].”
BackgroundFast dictionary attacks on passwords using time-space tradeoff
Narayanan, A., & Shmatikov, V. (2005) · Proceedings of the 12th ACM conference on Computer and communications security · doi:10.1145/1102120.1102168 · Cited by 447
Are your participants gaming the system?: screening mechanical turk workers
Downs, J. S., Holbrook, M. B., Sheng, S., & Cranor, L. F. (2010) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1753326.1753688 · Cited by 418
Self-citationTesting metrics for password creation policies by attacking large sets of revealed passwords
Weir, M., Aggarwal, S., Collins, M., & Stern, H. (2010) · Proceedings of the 17th ACM conference on Computer and communications security · doi:10.1145/1866307.1866327 · Cited by 411
Password management strategies for online accounts
Gaw, S., & Felten, E. W. (2006) · Proceedings of the second symposium on Usable privacy and security - SOUPS '06 · doi:10.1145/1143120.1143127 · Cited by 369
Of passwords and people: measuring the effect of password-composition policies
Komanduri, S., Shay, R., Kelley, P. G., Mazurek, M. L., Bauer, L., Christin, N., Cranor, L. F., & Egelman, S. (2011) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1978942.1979321 · Cited by 345
Self-citationThe true cost of unusable password policies: password use in the wild
Inglesant, P. G., & Sasse, M. A. (2010) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1753326.1753384 · Cited by 326
Encountering stronger password requirements: user attitudes and behaviors
Shay, R., Komanduri, S., Kelley, P. G., Leon, P. G., Mazurek, M. L., Bauer, L., Christin, N., & Cranor, L. F. (2010) · Proceedings of the Sixth Symposium on Usable Privacy and Security · doi:10.1145/1837110.1837113 · Cited by 305
Self-citationPassword Strength: An Empirical Analysis
Dell'Amico, M., Michiardi, P., & Roudier, Y. (2010) · 2010 Proceedings IEEE INFOCOM · doi:10.1109/infcom.2010.5461951 · Cited by 290
Password Security: An Empirical Study
Zviran, M., & Haga, W. J. (1999) · Journal of Management Information Systems · doi:10.1080/07421222.1999.11518226 · Cited by 252
Electronic authentication guideline
Burr, W. E., Dodson, D. F., & Polk, W. T. (2004) · doi:10.6028/nist.sp.800-63v1.0.1 · Cited by 241
Human selection of mnemonic phrase-based passwords
Kuo, C., Romanosky, S., & Cranor, L. F. (2006) · doi:10.1145/1143120.1143129 · Cited by 212
Self-citationImproving password security and memorability to protect personal and organizational information
Vu, K.-P. L., Proctor, R. W., Bhargav-Spantzel, A., Tai, B.-L. (., Cook, J., & Eugene Schultz, E. (2007) · International Journal of Human-Computer Studies · doi:10.1016/j.ijhcs.2007.03.007 · Cited by 206
Multiple password interference in text passwords and click-based graphical passwords
Chiasson, S., Forget, A., Stobert, E., van Oorschot, P. C., & Biddle, R. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653722 · Cited by 176
The security of modern password expiration: an algorithmic framework and empirical analysis
Zhang, Y., Monrose, F., & Reiter, M. K. (2010) · Proceedings of the 17th ACM conference on Computer and communications security · doi:10.1145/1866307.1866328 · Cited by 169
Making Passwords Secure and Usable
Adams, A., Sasse, M. A., & Lunt, P. (1997) · People and Computers XII · doi:10.1007/978-1-4471-3601-9_1 · Cited by 164
Where do security policies come from?
Florencio, D. A. F., & Herley, C. (2010) · Symposium On Usable Privacy and Security · doi:10.1145/1837110.1837124 · Cited by 158
Adaptive Password-Strength Meters from Markov Models
Castelluccia, C., Dürmuth, M., & Perito, D. (2012) · HAL (Le Centre pour la Communication Scientifique Directe) · Cited by 150
Improving system security via proactive password checking
Bishop, M., & Klein, D. V. (1995) · Computers & Security · doi:10.1016/0167-4048(95)00003-q · Cited by 150
OPUS: Preventing weak password choices
Spafford, E. H. (1992) · Computers & Security · doi:10.1016/0167-4048(92)90207-8 · Cited by 143
Popularity is everything A new approach to protecting passwords from statistical-guessing attacks
Schechter, S. E., Herley, C., & Mitzenmacher, M. (2010) · Cited by 104
Utility of human-computer interactions: toward a science of preference measurement
Toomim, M., Kriplean, T., Pörtner, C., & Landay, J. (2011) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1978942.1979277 · Cited by 64
Marechal, S. (2007) · Journal of Computer Virology and Hacking Techniques · doi:10.1007/s11416-007-0064-y · Cited by 63
Order and entropy in picture passwords
Komanduri, S., & Hutchings, D. R. (2008) · Cited by 57
Self-citationUsing Fingerprint Authentication to Reduce System Security: An Empirical Study
Wimberly, H., & Liebrock, L. M. (2011) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2011.35 · Cited by 46
Verheul, E. R. (2006) · Lecture notes in computer science · doi:10.1007/11967668_4 · Cited by 18
Cited by
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords
Bonneau, J. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.49 · Cited by 687
The Tangled Web of Password Reuse
Das, A., Bonneau, J., Caesar, M., Borisov, N., & Wang, X. (2014) · Proceedings 2014 Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23357 · Cited by 437
A Survey on Systems Security Metrics
Pendleton, M., Garcia-Lebron, R., Cho, J.-H., & Xu, S. (2017) · ACM Computing Surveys · doi:10.1145/3005714 · Cited by 283
Digital identity guidelines: authentication and lifecycle management
Grassi, P. A., Fenton, J. L., Newton, E. M., Perlner, R. A., Regenscheid, A. R., Burr, W. E., Richer, J. P., Lefkovitz, N. B., Danker, J. M., Choong, Y.-Y., et al. (2017) · doi:10.6028/nist.sp.800-63b · Cited by 261
(2017) · doi:10.1145/3133956.3134067 · Cited by 187
Metadata
- Authors
- Kelley, P. G., Komanduri, S., Mazurek, M. L., Shay, R., Vidas, T., Bauer, L., Christin, N., Cranor, L. F., & Lopez, J.
- Venue
- 2012 IEEE Symposium on Security and Privacy
- Publisher
- IEEE
- Published
- 2012-05
- Pages
- 523-537
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2054626033
- Cited by
- 397
- References
- 39
- FWCI
- 30.07
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
