The DOI matches its Crossref record; 2 of the 2 references it cites were found in a registry or an index.
Testing metrics for password creation policies by attacking large sets of revealed passwords
Abstract
In this paper we attempt to determine the effectiveness of using entropy, as defined in NIST SP800-63, as a measurement of the security provided by various password creation policies. This is accomplished by modeling the success rate of current password cracking techniques against real user passwords. These data sets were collected from several different websites, the largest one containing over 32 million passwords. This focus on actual attack methodologies and real user passwords quite possibly makes this one of the largest studies on password security to date. In addition we examine what these results mean for standard password creation policies, such as minimum password length, and character set requirements.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
A Mathematical Theory of Communication
Shannon, C. E. (1948) · Bell System Technical Journal · doi:10.1002/j.1538-7305.1948.tb01338.x · Cited by 88,486
Massey, J. L. (2002) · Proceedings of 1994 IEEE International Symposium on Information Theory · doi:10.1109/isit.1994.394764 · Cited by 463 · cited 3×
“The most notable papers covering the subject have been [7, 8], but those studies focused exclusively on the theoretical underpinnings of trying to convert the Shannon entropy to the Guessing entropy of a system, and did not verify their findings using real user passwords.”
Background
Cited by
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords
Bonneau, J. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.49 · Cited by 687
Wang, D., Cheng, H., Wang, P., Huang, X., & Jian, G. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2721359 · Cited by 499
A Survey on Systems Security Metrics
Pendleton, M., Garcia-Lebron, R., Cho, J.-H., & Xu, S. (2017) · ACM Computing Surveys · doi:10.1145/3005714 · Cited by 283
Digital identity guidelines: authentication and lifecycle management
Grassi, P. A., Fenton, J. L., Newton, E. M., Perlner, R. A., Regenscheid, A. R., Burr, W. E., Richer, J. P., Lefkovitz, N. B., Danker, J. M., Choong, Y.-Y., et al. (2017) · doi:10.6028/nist.sp.800-63b · Cited by 261
Towards Baselines for Shoulder Surfing on Mobile Authentication
Aviv, A. J., Davin, J. T., Wolf, F., & Kuber, R. (2017) · Proceedings of the 33rd Annual Computer Security Applications Conference · doi:10.1145/3134600.3134609 · Cited by 45
Metadata
- Authors
- Weir, M., Aggarwal, S., Collins, M., & Stern, H.
- Venue
- Proceedings of the 17th ACM conference on Computer and communications security
- Publisher
- ACM
- Published
- 2010-10-04
- Pages
- 162-175
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2097267243
- Cited by
- 411
- References
- 2
- FWCI
- 15.74
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Testing metrics for password creation policies by attacking large sets of revealed passwords. https://app.cochat.ai/papers/10.1145/1866307.1866327
- The paper
- Weir, M., Aggarwal, S., Collins, M., & Stern, H. (2010). Testing metrics for password creation policies by attacking large sets of revealed passwords. Proceedings of the 17th ACM conference on Computer and communications security. https://doi.org/10.1145/1866307.1866327
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
