Strength Analysis of Real-Life Passwords Using Markov Models
Source abstract
Abstract
Recent literature proposes the use of a proactive password checker as method for preventing users from creating easy-to-guess passwords. Markov models can help us create a more effective password checker that would be able to check the probability of a given password to be chosen by an attacker. We investigate the ability of different Markov models to calculate a variety of passwords from different topics, in order to find out whether one Markov model is sufficient for creating a more effective password checker. The results of our study show that multiple models are required in order to be able to do strength calculations for a wide range of passwords. To the best of our knowledge, this is the first password strength study where the effect of the training password datasets on the success of the model is investigated.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: User Authentication and Security Systems · Advanced Malware Detection Techniques · Biometric Identification and Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Electrical Engineering and Computer Science, University of Maribor, 2000 Maribor, Slovenia
Funding
Javna Agencija za Raziskovalno Dejavnost RS · European Union's Horizon 2020 Research and Innovation Program
References (34)
Show source-provided references
1. Threats to Information Systems: Today’s Reality, Yesterday’s Understanding10.2307/249574 ↗
2. Authenticating passwords over an insecure channel10.1016/0167-4048(96)00004-1 ↗
3. Relationships between Password Choices, Perceptions of Risk and Security Expertise
4. Password Security: A Case History10.1145/359168.359172 ↗
5. Improving system security via proactive password checking10.1016/0167-4048(95)00003-Q ↗
6. Yan, J.J. (2001, January 10). A Note on Proactive Password Checking. Proceedings of the 2001 Workshop on New Security Paradigms, Cloudcroft, NM, USA.10.1145/508171.508194 ↗
7. Improving computer security for authentication of users: Influence of proactive password restrictions10.3758/BF03195438 ↗
8. Improving Password Security and Memorability to Protect Personal and Organizational Information10.1016/j.ijhcs.2007.03.007 ↗
9. Dell’ Amico, M., Michiardi, P., and Roudier, Y. (2010, January 14–19). Password Strength: An Empirical Analysis. Proceedings of the 2010 Proceedings IEEE INFOCOM, San Diego, CA, USA.10.1109/INFCOM.2010.5461951 ↗
10. Narayanan, A., and Shmatikov, V. (2005, January 7–11). Fast Dictionary Attacks on Passwords Using Time-space Tradeoff. Proceedings of the 12th ACM Conference on Computer and Communications Security CCS ’05, Alexandria, VA, USA.10.1145/1102120.1102168 ↗
11. Advances in password cracking10.1007/s11416-007-0064-y ↗
12. Castelluccia, C., Dürmuth, M., and Perito, D. (2012, January 5–8). Adaptive password-strength meters from Markov models. Proceedings of the 19th Annual Network and Distributed System Security Symposium, Hilton, San Diego, CA, USA.
13. Ma, J., Yang, W., Luo, M., and Li, N. (2014, January 18–21). A Study of Probabilistic Password Models. Proceedings of the 2014 IEEE Symposium on Security and Privacy, Berkeley, CA, USA.10.1109/SP.2014.50 ↗
14. Wang, D., He, D., Cheng, H., and Wang, P. (July, January 28). fuzzyPSM: A New Password Strength Meter Using Fuzzy Probabilistic Context-Free Grammars. Proceedings of the 2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Toulouse, France.10.1109/DSN.2016.60 ↗
15. Galbally, J., Coisel, I., and Sanchez, I. (2014, January 13–16). A probabilistic framework for improved password strength metrics. Proceedings of the 2014 International Carnahan Conference on Security Technology (ICCST), Rome, Italy.10.1109/CCST.2014.6986985 ↗
16. Wang, D., Wang, P., He, D., and Tian, Y. Birthday, Name and Bifacial-Security: Understanding Passwords of Chinese Web Users. Proceedings of the 28th USENIX Conference on Security Symposium (USENIX Security 19).
17. Egelman, S., Sotirakopoulos, A., Muslukhov, I., Beznosov, K., and Herley, C. (May, January 27). Does My Password Go Up to Eleven?: The Impact of Password Meters on Password Selection. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, Paris, France.
18. Weir, M., Aggarwal, S., Collins, M., and Stern, H. (2010, January 4–8). Testing metrics for password creation policies by attacking large sets of revealed passwords. Proceedings of the 17th ACM Conference on Computer and Communications Security-CCS ’10, Chicago, IL, USA.10.1145/1866307.1866327 ↗
19. Weir, M., Aggarwal, S., de Medeiros, B., and Glodek, B. (2009, January 17–20). Password Cracking Using Probabilistic Context-Free Grammars. Proceedings of the 2009 30th IEEE Symposium on Security and Privacy, Oakland, CA, USA.10.1109/SP.2009.8 ↗
20. Next Gen PCFG Password Cracking10.1109/TIFS.2015.2428671 ↗
21. (2019, April 16). John the Ripper Password Cracker. Available online: https://www.openwall.com/john/.
22. Sutskever, I., Martens, J., and Hinton, G. (July, January 28). Generating Text with Recurrent Neural Networks. Proceedings of the 28th International Conference on International Conference on Machine Learning Omnipress ICML’11, Washington, DC, USA.
23. Graves, A. (2013). Generating Sequences With Recurrent Neural Networks. arXiv.10.1007/978-3-642-24797-2_3 ↗
24. Neural Network Techniques for Proactive Password Checking10.1109/TDSC.2006.53 ↗
25. Melicher, W., Ur, B., Segreti, S.M., Komanduri, S., Bauer, L., Christin, N., and Cranor, L.F. (2016, January 10–12). Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks. Proceedings of the 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, Austin, TX, USA.
26. A tutorial on hidden Markov models and selected applications in speech recognition10.1109/5.18626 ↗
27. (2019, March 10). Passwords. Available online: https://wiki.skullsecurity.org/Passwords/.
28. (2019, March 15). Today I Am Releasing Ten Million Passwords. Available online: https://xato.net/today-i-am-releasing-ten-million-passwords-b6278bbe7495.
29. (2019, March 16). Large Password List: Free Download Dictionary File for Password Cracking. Available online: https://breakthesecurity.cysecurity.org/2011/12/large-password-list-free-download-dictionary-file-for-password-cracking.html.
30. (2019, March 16). 10,000 Top Passwords. Available online: https://xato.net/10-000-top-passwords-6d6380716fe0.
31. Voyiatzis, A.G., Fidas, C.A., Serpanos, D.N., and Avouris, N.M. (October, January 30). An Empirical Study on the Web Password Strength in Greece. Proceedings of the 2011 15th Panhellenic Conference on Informatics, Kastoria, Greece.10.1109/PCI.2011.6 ↗
32. Survival of the Shortest: A Retrospective Analysis of Influencing Factors on Password Composition10.1007/978-3-642-40477-1_28 ↗
33. Cohen, J. (1977). {CHAPTER} 1-The Concepts of Power Analysis. Statistical Power Analysis for the Behavioral Sciences (Revised Edition), Academic Press. [Revised Edition ed.].10.1016/B978-0-12-179060-8.50006-2 ↗
34. (2019, April 20). Hashcat, Advanced Password Recovery. Available online: https://hashcat.net/wiki/.