Abstract:Although it is common for users to select bad passwords that can be easily cracked by attackers, password-based authentication remains the most widely-used method. To encourage users to select good passwords, enterprises often enforce policies. Such policies have been proven to be ineffectual in practice. Accurate assessment of a password's resistance to cracking attacks is still an unsolved problem, and our work addresses this challenge. Although the best way to determine how difficult it may be to crack a user-selected password is to check its resistance to cracking attacks employed by attackers in the wild, implementing such a strategy at an enterprise would be infeasible in practice. We first formalize the concepts of password complexity and strength with concrete definitions emphasizing their differences. Our framework captures human biases and many known techniques attackers use to recover stolen credentials in real life, such as brute-force attacks. Building on our definitions, we develop a general framework for calculating password complexity and strength that could be used in practice. Our approach is based on the key insight that an attacker's success at cracking a password must be defined by its available computational resources, time, function used to store that password, as well as the topology that bounds that attacker's search space based on that attacker's available inputs, transformations it can use to tweak and explore its inputs, and the path of exploration which can be based on the attacker's perceived probability of success. We also provide a general framework for assessing the accuracy of password complexity and strength estimators that can be used to compare other tools available in the wild.

Fixing the Fixes: Assessing the Solutions of SAST Tools for Securing Password Storage

Why Johnny Can't Store Passwords Securely? A Usability Evaluation of Bouncycastle Password Hashing

"Do this! Do that!, And nothing will happen" Do specifications lead to securely stored passwords?

Advances in Password Security

Password security: Password behavior analysis at a small university

Philosophical Survey of Passwords

A Study for an Ideal Password Management System

Client-Side Hashing for Efficient Typo-Tolerant Password Checkers

"False negative -- that one is going to kill you": Understanding Industry Perspectives of Static Analysis based Security Testing

General Framework for Evaluating Password Complexity and Strength

Tales from the Git: Automating the detection of secrets on code and assessing developers' passwords choices

Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks

That Was Then, This Is Now: A Security Evaluation of Password Generation, Storage, and Autofill in Thirteen Password Managers

Amogap: Defending Against Man-In-The-Middle And Offline Guessing Attacks On Passwords

CSPS: Catchy Short Passwords Making Offline and Online Attacks Impossible

Secure Coding Practices in Java: Challenges and Vulnerabilities

Securing Password Authentication for Web-based Applications

Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools

Password Cracking and Countermeasures in Computer Security: A Survey

Studying the Impact of Managers on Password Strength and Reuse

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.