Abstract:Although it is common for users to select bad passwords that can be easily cracked by attackers, password-based authentication remains the most widely-used method. To encourage users to select good passwords, enterprises often enforce policies. Such policies have been proven to be ineffectual in practice. Accurate assessment of a password's resistance to cracking attacks is still an unsolved problem, and our work addresses this challenge. Although the best way to determine how difficult it may be to crack a user-selected password is to check its resistance to cracking attacks employed by attackers in the wild, implementing such a strategy at an enterprise would be infeasible in practice. We first formalize the concepts of password complexity and strength with concrete definitions emphasizing their differences. Our framework captures human biases and many known techniques attackers use to recover stolen credentials in real life, such as brute-force attacks. Building on our definitions, we develop a general framework for calculating password complexity and strength that could be used in practice. Our approach is based on the key insight that an attacker's success at cracking a password must be defined by its available computational resources, time, function used to store that password, as well as the topology that bounds that attacker's search space based on that attacker's available inputs, transformations it can use to tweak and explore its inputs, and the path of exploration which can be based on the attacker's perceived probability of success. We also provide a general framework for assessing the accuracy of password complexity and strength estimators that can be used to compare other tools available in the wild.

Adaptive and Maladaptive Factors behind Password Manager Use: A Hope-Extended Protection Motivation Perspective

Studying the Impact of Managers on Password Strength and Reuse

Prospects for Improving Password Selection

That Was Then, This Is Now: A Security Evaluation of Password Generation, Storage, and Autofill in Thirteen Password Managers

Passwords and Perceptions.

How memory anxiety can influence password security behavior

Why Older Adults (Don't) Use Password Managers

Password Expiration Strategy: A Perspective of Ecological Memory

A Study for an Ideal Password Management System

Nudging Users to Change Breached Passwords Using the Protection Motivation Theory

Passwords Are Meant to Be Secret: A Practical Secure Password Entry Channel for Web Browsers

Strong password? Not with your social network data!

Protection or Cynicism? Dual Strategies for Coping with Privacy Threats

General Framework for Evaluating Password Complexity and Strength

User Motivations in Protecting Information Security: Protection Motivation Theory Versus Self-Determination Theory

Advances in Password Security

Update-tolerant and Revocable Password Backup (Extended Version)

Improving password security and memorability to protect personal and organizational information

A Large-Scale Survey of Password Entry Practices on Non-Desktop Devices

The Emperor is Now Clothed: A Secure Governance Framework for Web User Authentication through Password Managers

Improving Users' Passwords with DPAR: a Data-driven Password Recommendation System