Abstract:To provide timely feedbacks to users, nearly every respectable Internet service now imposes a password strength meter (PSM) upon user registration or password change. It is a rare bit of good news in password research that well-designed PSMs do help improve the strength of user-chosen passwords. However, leading PSMs in the industrial world (e.g., Zxcvbn, KeePSM and NIST PSM) are mainly composed of simple heuristic rules and found to be highly inaccurate, while state-of-the-art PSMs from academia (e.g., probabilistic context-free grammar based ones and Markov-based ones) are still far from satisfactory, especially incompetent at gauging weak passwords. As preventing weak passwords is the primary goal of any PSM, this means that existing PSMs largely fail to serve their purpose. To fill this gap, in this paper we propose a novel PSM that is grounded on real user behavior. Our user survey reveals that when choosing passwords for a new web service, most users (77.38%) simply retrieve one of their existing passwords from memory and then reuse (or slightly modify) it. This is in vast contrast to the seemingly intuitive yet unrealistic assumption (often implicitly) made in most of the existing PSMs that, when user registers, a whole new password is constructed by mixing segments of letter, digit and/or symbol or by combining n-grams. To model users' realistic behaviors, we use passwords leaked from a less sensitiveservice as our base dictionary and another list of relatively strong passwords leaked from a sensitive service as our training dictionary, and determine how mangling rules are employed by users to construct passwords for new services. This process automatically creates a fuzzy probabilistic context-free grammar (PCFG) and gives rise to our fuzzy-PCFG-based meter, fuzzyPSM. It can react dynamically to changes in how users choose passwords and is evaluated by comparisons with five representative PSMs. Extensive experiments on 11 real-world password lists show that fuzzyPSM, in general, outperforms all its counterparts, especially accurate in telling apart weak passwords and suitable for services where online guessing attacks prevail.

Group Password Strength Meter Based on Attention Mechanism

User Practice in Password Security: an Empirical Study of Real-Life Passwords in the Wild

Advances in Password Security

Recurrent Neural Network Based Password Generation for Group Attribute Context-Ware Applications.

Password strength estimation model based on ensemble learning

Mangling Rules Generation with Density-Based Clustering for Password Guessing

Password Enhancement Based on Semantic Transformation.

Password Strength Analysis: A Survey

Deep Learning for Password Guessing and Password Strength Evaluation, A Survey

Analysis of Real Password Based on Attributes Resolution and Data Mining

Chunk-Level Password Guessing: Towards Modeling Refined Password Composition Representations

A Study on Markov-Based Password Strength Meters

An Explainable Password Strength Meter Addon Via Textual Pattern Recognition.

Research on Multi-Granularity Password Analysis Based on LLM

PassTSL: Modeling Human-Created Passwords through Two-Stage Learning

Analysis Method of Password Attributes Based on Neural Network

fuzzyPSM: A New Password Strength Meter Using Fuzzy Probabilistic Context-Free Grammars

General Framework for Evaluating Password Complexity and Strength

Improving password security and memorability to protect personal and organizational information

User biometric information-based secure method for smart devices.

DeepMnemonic: Password Mnemonic Generation via Deep Attentive Encoder-Decoder Model