Guess again (and again and again) Measuring password strength by simulating password-cracking algorithms Patrick Gage Kelley, Saranga Komanduri, Michelle L. Mazurek, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Julio Lopez. In 2012 IEEE Symposium on Security and Privacy (SP), pp. 523-537. IEEE, 2012 Presented by Rain Qin

Paper Summary In this paper, the authors analyzed a dataset of 12,000 plaintext passwords collected under different password-composition policies through using Amazon’s Mechanical Turk crowdsourcing service. They implemented two guess-number calculators Weir algorithm calculator BFM algorithm calculator They found the dictionary effectiveness check depends on the choice of dictionary effective attacks on passwords created under complex policies require access to closely matched training data In these different password-composition policies, one called basic16 is the best choice

Policies basic8survey:Password must have at least 8 characters (e.g. awordpswd) dictionary8:Password must have at least 8 characters.It may not contain a dictionary word (e.g. asdfghjk) comprehensive8: Password must have at least 8 characters including an uppercase and lowercase letter, a symbol, and a digit. It may not contain a dictionary word.(e.g. *IK<;lo9) basic16:Password must have at least 16 characters. (e.g. qwertyuioplkjhgf)

Cracked Result Use weir calculator

Cracked Result Use BFM calculator

Conclusion Basic16 is superior against large numbers of guesses. Two guess-number calculators reveal basic16 is the best policy choice.

Thank you~

Concepts Amazon Mechanical Turk (ref https://en.wikipedia.org/wiki/Amazon_Mechanical_Turk) Policies: basic8: Participants were given the email scenario and the composition policy “Password must have at least 8 characters.” Only the scenario differs from basic8survey. blacklistEasy: Password must have at least 8 characters. It may not contain a dictionary word. blacklistMedium: Same as the blacklistEasy condition, except the authors used the paid Openwall list blacklistHard: Same as the blacklistEasy condition, except the authors used a five-billion-word dictionary created using the algorithm outlined by Weir Two guess-number calculators Brute-force algorithm loosely based on the Markov model Heuristic algorithm proposed by Weir

Poor Practicality hard to remember

Poor Practicality (cont.) " gi1%isbrt,90%psbrt. " motto / dictum "Genius is one percent inspiration, ninety-nine percent perspiration."