Abstract:Textual passwords are still the most widely used user authentication mechanism. Due to the close connections between textual passwords and natural languages, advanced technologies in natural language processing (NLP) and machine learning (ML) could be used to model passwords for different purposes such as studying human password-creation behaviors and developing more advanced password cracking methods for informing better defence mechanisms. In this paper, we propose PassTSL (modeling human-created Passwords through Two-Stage Learning), inspired by the popular pretraining-finetuning framework in NLP and deep learning (DL). We report how different pretraining settings affected PassTSL and proved its effectiveness by applying it to six large leaked password databases. Experimental results showed that it outperforms five state-of-the-art (SOTA) password cracking methods on password guessing by a significant margin ranging from 4.11% to 64.69% at the maximum point. Based on PassTSL, we also implemented a password strength meter (PSM), and our experiments showed that it was able to estimate password strength more accurately, causing fewer unsafe errors (overestimating the password strength) than two other SOTA PSMs when they produce the same rate of safe errors (underestimating the password strength): a neural-network based method and zxcvbn. Furthermore, we explored multiple finetuning settings, and our evaluations showed that, even a small amount of additional training data, e.g., only 0.1% of the pretrained data, can lead to over 3% improvement in password guessing on average. We also proposed a heuristic approach to selecting finetuning passwords based on JS (Jensen-Shannon) divergence and experimental results validated its usefulness. In summary, our contributions demonstrate the potential and feasibility of applying advanced NLP and ML methods to password modeling and cracking.

DeepMnemonic: Password Mnemonic Generation via Deep Attentive Encoder-Decoder Model

Generating and Managing Strong Passwords using Hotel Mnemonic

Mangling Rules Generation with Density-Based Clustering for Password Guessing

PassTSL: Modeling Human-Created Passwords through Two-Stage Learning

Chunk-Level Password Guessing: Towards Modeling Refined Password Composition Representations

Mnemonic Dictionary Learning for Intrinsic Motivation in Reinforcement Learning

Unlocking Memorization in Large Language Models with Dynamic Soft Prompting

A SMART Mnemonic Sounds like "Glue Tonic": Mixing LLMs with Student Feedback to Make Mnemonic Learning Stick

Digit Semantics Based Optimization for Practical Password Cracking Tools.

Empirical study on lexical sentiment in passwords from Chinese websites

WordMarkov: A New Password Probability Model of Semantics

An Algorithm to Generate Password Structure Dictionary Based on Gene Bank

PassGPT: Password Modeling and (Guided) Generation with Large Language Models

Amogap: Defending Against Man-In-The-Middle And Offline Guessing Attacks On Passwords

A Neural Attack Model for Cracking Passwords in Adversarial Environments

PagPassGPT: Pattern Guided Password Guessing via Generative Pretrained Transformer

The weak password problem: chaos, criticality, and encrypted p-CAPTCHAs

Neuromuscular Password-Based User Authentication

MemGEN: Memory is All You Need

Reducing Bias in Modeling Real-world Password Strength via Deep Learning and Dynamic Dictionaries

PassTCN-PPLL: A Password Guessing Model Based on Probability Label Learning and Temporal Convolutional Neural Network