Comparing Password Ranking Algorithms on Real-World Password Datasets

  • Weining Yang
  • Ninghui Li
  • Ian M. Molloy
  • Youngja Park
  • Suresh N. Chari
Conference paper

DOI: 10.1007/978-3-319-45744-4_4

Part of the Lecture Notes in Computer Science book series (LNCS, volume 9878)
Cite this paper as:
Yang W., Li N., Molloy I.M., Park Y., Chari S.N. (2016) Comparing Password Ranking Algorithms on Real-World Password Datasets. In: Askoxylakis I., Ioannidis S., Katsikas S., Meadows C. (eds) Computer Security – ESORICS 2016. ESORICS 2016. Lecture Notes in Computer Science, vol 9878. Springer, Cham

Abstract

Password-based authentication is the most widely used authentication mechanism. One major weakness of password-based authentication is that users generally choose predictable and weak passwords. In this paper, we address the question: How to best check weak passwords? We model different password strength checking methods as Password Ranking Algorithms (PRAs), and introduce two methods for comparing different PRAs: the \(\beta \)-Residual Strength Graph (\(\beta \)-RSG) and the Normalized \(\beta \)-Residual Strength Graph (\(\beta \)-NRSG). In our experiments, we find some password datasets that have been widely used in password research contain many problematic passwords that are not naturally created. We develop techniques to cleanse password datasets by removing these problematic accounts. We then apply the two metrics on cleansed datasets and show that several PRAs, including the dictionary-based PRA, the Markov Models with and without backoff, have similar performances. If the size of PRAs are limited in order to be able to be transmitted over the internet, a hybrid method combining a small dictionary of weak passwords and a Markov model with backoff with a limited size can provide the most accurate strength measurement.

Copyright information

© Springer International Publishing Switzerland 2016

Authors and Affiliations

  • Weining Yang
    • 1
  • Ninghui Li
    • 1
  • Ian M. Molloy
    • 2
  • Youngja Park
    • 2
  • Suresh N. Chari
    • 2
  1. 1.Purdue UniversityWest LafayetteUSA
  2. 2.IBM T. J. Watson Research CenterYorktown HeightsUSA

Personalised recommendations