Analysis of passwords: Towards understanding of strengths and weaknesses

Abstract

In this paper, we analyze the passwords' strength from real-world data; perform an in-depth analysis, and extract useful information related to the millions of usernames and passwords being utilized. This useful information thus represents the millions of minds and the individual behaviors in online and offline passwords based information systems. From the twelve million usernames and passwords, we investigate density, numbers in usernames and passwords, special characters, and strength analysis of the usernames and passwords. To the best of our knowledge, this work is unique based on the selected parameters and the amount of processed data. With the extensive analysis, we seek the weak link in the username and password paradigm. With density analysis, it can be deduced that users like to have (or by chance use) similar character usernames and passwords. From the digits analysis in passwords, it is found that users like to use the first few digits (1, 2, and 3) and the last digits (8, 9, and 0). With the special character analysis, we found that "_" is the most widely used character. With the strength analysis, we determined that it is better to use non-popular English vocabulary words and the inclusion of the special characters, lower, upper and digits are in between different words. Also, if a word can be converted to other languages and used as a password, it will be extremely robust. Most users use their username partly or fully as passwords. This opens doors for hackers. The extensive experimentation and results in the appropriate sections provide useful contributions.

An empirical study on differences between self-assessed and measured real risk in online behaviour

“…The quality of the password, e.g., how the password is constructed, differs between students, average users, and professionals [17]. Average online users like having and using usernames and passwords with similar characters -the first few digits or the last few digits in a decade system, while the most used unique character is the underscore sign [18]. Additionally, male users have significantly stronger passwords than female ones, and password complexity decreases with age [19].…”