1.  Patrick Gage Kelley, et al. “Guess again (and again and again): [...].” In 2012 IEEE Symposium on Security and Privacy (SP), pp. 523-537. IEEE, 2012. Timothy D. Widjaja

2.  Measuring password strength by simulating password- cracking algorithms  Gather passwords under various policies, then train the algorithms on various dictionaries; compare the guessability of passwords from those policies using those dictionaries  Guessability is measured by calculating how long the algorithms would take to discover a password  Password creation policies may influence a user’s choice of password in ways more “predictable” than intended  Password cracking algorithms can become very successful if tailored to a given password creation policy

3.  A word mangling algorithm is trained on a dictionary apple banana cherry... apple banana cherry... Word Mangling Algorithm apple1234 a.p.p.l.e aaaaapple 4PPL3 binini BaNaNa ba-na-na banananana cherry!!! cherrie che~e~erry cherrycherry... apple1234 a.p.p.l.e aaaaapple 4PPL3 binini BaNaNa ba-na-na banananana cherry!!! cherrie che~e~erry cherrycherry... e.g. Weir, Brute-Force Markov, John the Ripper

4.  Consider password cracking as a guided traversal through the space of all possible passwords: “educated” brute-force  How does a password policy influence users in creating passwords? How does it affect the password distribution? Password Distribution Password Cracking Perimeter

5.  POLICIES: two different scenarios, four different “wordings”, eight different conditions dictionary8 blacklistEasy blacklistMedium blacklistHard basic8survey basic16comprehensive8 basic8

6.  FINDING: Training the cracking algorithm using other passwords gathered under the same policy improves cracking significantly for stringent policies, but only slightly for lenient policies Ideal Situation Actual Situation

7.  FINDING: The guessability of passwords created under some policy is not equivalent to the guessability of passwords created under different policies that happen to conform to that policy No Restriction Apply Restriction X