1. Guess again (and again and again) Measuring password strength by simulating password-cracking algorithms Patrick Gage Kelley, Saranga Komanduri, Michelle L. Mazurek, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Julio Lopez. In 2012 IEEE Symposium on Security and Privacy (SP), pp IEEE, 2012
Presented by Rain Qin

2. Paper Summary
In this paper, the authors analyzed a dataset of 12,000 plaintext passwords collected under different password-composition policies through using Amazon’s Mechanical Turk crowdsourcing service.
They implemented two guess-number calculators
Weir algorithm calculator
BFM algorithm calculator
They found
the dictionary effectiveness check depends on the choice of dictionary
effective attacks on passwords created under complex policies require access to closely matched training data
In these different password-composition policies, one called basic16 is the best choice

3. Policies basic8survey:Password must have at least 8 characters
(e.g. awordpswd)
dictionary8:Password must have at least 8 characters.It may not contain a dictionary word
(e.g. asdfghjk)
comprehensive8: Password must have at least 8 characters including an uppercase and lowercase letter, a symbol, and a digit. It may not contain a dictionary word.(e.g. *IK<;lo9)
basic16:Password must have at least 16 characters.
(e.g. qwertyuioplkjhgf)

4. Cracked Result
Use weir calculator

5. Cracked Result
Use BFM calculator

6. Conclusion Basic16 is superior against large numbers of guesses.
Two guess-number calculators reveal basic16 is the best policy choice.

7. Thank you~

8. Concepts
Amazon Mechanical Turk (ref
Policies:
basic8: Participants were given the scenario and the composition policy “Password must have at least 8 characters.” Only the scenario differs from basic8survey.
blacklistEasy: Password must have at least 8 characters. It may not contain a dictionary word.
blacklistMedium: Same as the blacklistEasy condition, except the authors used the paid Openwall list
blacklistHard: Same as the blacklistEasy condition, except the authors used a five-billion-word dictionary created using the algorithm outlined by Weir
Two guess-number calculators
Brute-force algorithm loosely based on the Markov model
Heuristic algorithm proposed by Weir

9. Poor Practicality
hard to remember

10. Poor Practicality (cont.)
" gi1%isbrt,90%psbrt. "
motto / dictum
"Genius is one percent inspiration, ninety-nine percent perspiration."