1. HOW CAN ATTACKERS READ YOUR MIND? Telepathwords: Preventing Weak Passwords By Reading Users’ Minds Saranga, K., Richard, S., lorrie, F.C., Cormac, H. and Stuart, S. (August, 2014). In the proceedings of the 23rd USENIX security symposium. Isbn 978-1-931971-15-7 Presented by ZHAI Yuxiao(Eric)

2. LEARNING FROM TEXAS HOLD’EM Level 0 -- Know nothing Level 1 -- Know what cards I have (at least know the rule) Level 2 -- Know what cards opponents have Level 3 -- Know what cards opponents believe I have Level 4 -- Know what cards opponents believe I believe they have … http://eoto.blogs.tamk.fi/author/b4asvidk/

3. SUMMARY Background –Users are required to choose passwords that comply with certain policies Outline –Proposed a solution, the Telepathwords system –Described the design, implementation, human-subjects testing, public deployment and user response to the Telepathwords system My focus –Prediction Algorithms

4. USER INTERFACE

5. PREDICTION ALGORITHMS – DATA STRUCTURE A RESULT SETTRIE DATA STRUCTURE

6. PREDICTION ALGORITHMS – COMMON CHARACTER SEQUENCES LIKELIHOOD Likelihood increases with the length and frequency. A 1.5 GB English-language model derived from browser search queries A set of passwords which occurred five time or more in the RockYou dataset BEGIN ANYWHERE

7. PREDICTION ALGORITHMS – ‘PASSWORD-CREATION GUIDANCE’ LETTERS & DIGITSSUBSTITUTION One window walks the trie only where letters are typed One that does so only when digits are typed A table mapping common character substitution, such as 3 for e, $ for s, 0 for o Guide or misguide?

8. PREDICTION ALGORITHMS – OTHER TECHNIQUES Keyboard movements –X and Y coordinates represents row and column –A n-character prefix for a n-key-position sequence Repeated strings –Look for each repeated suffix of length n –The longer, the stronger prediction Interleaved strings –Split passwords to odd- and even-indexed characters –Run the other predictors on the substrings

9. Thank you!