Measuring Password Strength: An Empirical Analysis Export

@article{citeulike:5227086, abstract = {We present an in-depth analysis on the strength of the almost 10,000 passwords from users of an instant messaging server in Italy. We estimate the strength of those passwords, and compare the effectiveness of state-of-the-art attack methods such as dictionaries and Markov chain-based techniques. We show that the strength of passwords chosen by users varies enormously, and that the cost of attacks based on password strength grows very quickly when the attacker wants to obtain a higher success percentage. In accordance with existing studies we observe that, in the absence of measures for enforcing password strength, weak passwords are common. On the other hand we discover that there will always be a subset of users with extremely strong passwords that are very unlikely to be broken. The results of our study will help in evaluating the security of password-based authentication means, and they provide important insights for inspiring new and better proactive password checkers and password recovery tools.}, archivePrefix = {arXiv}, author = {Dell'amico, Matteo and Michiardi, Pietro and Roudier, Yves}, citeulike-article-id = {5227086}, citeulike-linkout-0 = {http://arxiv.org/abs/0907.3402}, citeulike-linkout-1 = {http://arxiv.org/pdf/0907.3402}, day = {20}, eprint = {0907.3402}, keywords = {empirical-study, markov, measurement, password-recovery, passwords}, month = {Jul}, posted-at = {2009-08-26 15:33:22}, priority = {0}, title = {Measuring Password Strength: An Empirical Analysis}, url = {http://arxiv.org/abs/0907.3402}, year = {2009} }

TY - JOUR ID - citeulike:5227086 L3 - citeulike-article-id:5227086 N2 - We present an in-depth analysis on the strength of the almost 10,000 passwords from users of an instant messaging server in Italy. We estimate the strength of those passwords, and compare the effectiveness of state-of-the-art attack methods such as dictionaries and Markov chain-based techniques. We show that the strength of passwords chosen by users varies enormously, and that the cost of attacks based on password strength grows very quickly when the attacker wants to obtain a higher success percentage. In accordance with existing studies we observe that, in the absence of measures for enforcing password strength, weak passwords are common. On the other hand we discover that there will always be a subset of users with extremely strong passwords that are very unlikely to be broken. The results of our study will help in evaluating the security of password-based authentication means, and they provide important insights for inspiring new and better proactive password checkers and password recovery tools. TI - Measuring Password Strength: An Empirical Analysis KW - empirical-study KW - markov KW - measurement KW - password-recovery KW - passwords AU - Dell'amico, Matteo AU - Michiardi, Pietro AU - Roudier, Yves PY - 2009/Jul/20/ UR - http://arxiv.org/abs/0907.3402 ER -