Abstract:To provide timely feedbacks to users, nearly every respectable Internet service now imposes a password strength meter (PSM) upon user registration or password change. It is a rare bit of good news in password research that well-designed PSMs do help improve the strength of user-chosen passwords. However, leading PSMs in the industrial world (e.g., Zxcvbn, KeePSM and NIST PSM) are mainly composed of simple heuristic rules and found to be highly inaccurate, while state-of-the-art PSMs from academia (e.g., probabilistic context-free grammar based ones and Markov-based ones) are still far from satisfactory, especially incompetent at gauging weak passwords. As preventing weak passwords is the primary goal of any PSM, this means that existing PSMs largely fail to serve their purpose. To fill this gap, in this paper we propose a novel PSM that is grounded on real user behavior. Our user survey reveals that when choosing passwords for a new web service, most users (77.38%) simply retrieve one of their existing passwords from memory and then reuse (or slightly modify) it. This is in vast contrast to the seemingly intuitive yet unrealistic assumption (often implicitly) made in most of the existing PSMs that, when user registers, a whole new password is constructed by mixing segments of letter, digit and/or symbol or by combining n-grams. To model users' realistic behaviors, we use passwords leaked from a less sensitiveservice as our base dictionary and another list of relatively strong passwords leaked from a sensitive service as our training dictionary, and determine how mangling rules are employed by users to construct passwords for new services. This process automatically creates a fuzzy probabilistic context-free grammar (PCFG) and gives rise to our fuzzy-PCFG-based meter, fuzzyPSM. It can react dynamically to changes in how users choose passwords and is evaluated by comparisons with five representative PSMs. Extensive experiments on 11 real-world password lists show that fuzzyPSM, in general, outperforms all its counterparts, especially accurate in telling apart weak passwords and suitable for services where online guessing attacks prevail.

Online Password Guessability via Multi-Dimensional Rank Estimation

Mangling Rules Generation with Density-Based Clustering for Password Guessing

Password guessers under a microscope: an in-depth analysis to inform deployments

Prospects for Improving Password Selection

An Alternative Method for Understanding User-Chosen Passwords.

Fool Me Once: A Study of Password Selection Evolution over the Past Decade

Understanding Offline Password-Cracking Methods: A Large-Scale Empirical Study

Improving Users' Passwords with DPAR: a Data-driven Password Recommendation System

Password Guessing Time Based on Guessing Entropy and Long-Tailed Password Distribution in the Large-Scale Password Dataset

On the Economics of Offline Password Cracking

Chunk-Level Password Guessing: Towards Modeling Refined Password Composition Representations

fuzzyPSM: A New Password Strength Meter Using Fuzzy Probabilistic Context-Free Grammars

Password Correlation: Quantification, Evaluation and Application.

Expectation Entropy as a Password Strength Metric

#Segments: A Dominant Factor of Password Security to Resist against Data-driven Guessing

Targeted Online Password Guessing

Zipf's Law in Passwords.

Revisiting Monte Carlo Strength Evaluation

1 Zipf ’ s Law in Passwords

General Framework for Evaluating Password Complexity and Strength

The Effect of Domain Terms on Password Security