Building better passwords using probabilistic techniques

Houshmand, Shiva; Aggarwal, Sudhir

doi:10.1145/2420950.2420966

Cited by 41 publications

(37 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Houshmand and Aggrawal [18] derived Markov-based password cracking algorithm from MarkovChain that representatively originated PageRank algorithm. Originally, Markov-based algorithm is not a probabilistic model; Ma et al [25] investigated password characteristics about length and the structure of 6 datasets, 3 of which were from Chinese websites and improved it by using different normalization and smoothing methods.…”

Section: Related Workmentioning

confidence: 99%

“…Ad hoc metrics (password strength meter) had already been demonstrated far from accurate by Weir et al [27]; they advocated that the cracking-based password strength meter was more compelling. Markov-based PSM [28] and PCFG-based PSM [18] were proposed subsequently based on Markov model and PCFG model. Wang et al [12] created a novel PSM on a solid foundation where user usually reuses one of his/her passwords rather than creating a new one.…”

Section: Related Workmentioning

confidence: 99%

“…In the literature of password, breaching of large-scale datasets of passwords have guided the studies of passwords to a more scientific and rigorous method. Password corpora have typically been used to analyze the distribution of passwords [16], names used in passwords and character distribution [9], or the priority among priorities: used as learning set to train probabilistic models such as PCFG-based [17], Markov-based [18], and NLP-based (Natural Language Processing) [19] password cracking algorithms in order to simulate adversarial password cracking process, leading to sophisticated password dataset strength evaluation methods [20]. The probabilistic password cracking models are afterwards modified elaborately by researchers to evaluate single password strength.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Alternative Method for Understanding User-Chosen Passwords

Zheng

Cheng

Zhang

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

We present in this paper an alternative method for understanding user-chosen passwords. In password research, much attention has been given to increasing the security and usability of individual passwords for common users. Few of them focus on the relationships between passwords; therefore we explore the relationships between passwords: modification-based, similarity-based, and probability-based. By regarding passwords as vertices, we shed light on how to transform a dataset of passwords into a password graph. Subsequently, we introduce some novel notions from graph theory and report on a number of inner properties of passwords from the perspective of graph. With the assistance of Python Graph-tool, we are able to visualize our password graph to deliver an intuitive grasp of user-chosen passwords. Five real-world password datasets are used in our experiments to fulfill our thorough experiments. We discover that (1) some passwords in a dataset are tightly connected with each other; (2) they have the tendency to gather together as a cluster like they are in a social network; (3) password graph has logarithmic distribution for its degrees. Top clusters in password graph could be exploited to obtain the effective mangling rules for cracking passwords. Also, password graph can be utilized for a new kind of password strength meter.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An Alternative Method for Understanding User-Chosen Passwords

Zheng

Cheng

Zhang

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…El problema que se presenta es que a pesar de que actualmente se cuenta con herramientas para la generación de contraseñas como "Random Password Generator" [7] o el Analyzer and Modifier for Passwords (AMP) 2 [8] que ayudan al usuario a generar contraseñas robustas manteniendo la usabilidad, y herramientas que generan claves aleatorias [9] o pseudoaleatorias [10], se siguen teniendo dificultades con el manejo de las mismas por parte del usuario final. Sin embargo, existe otra mirada como se observa en varias publicaciones de revistas científicas tipo A como la IEEE y ACM según estudios como [8] [15], centrados en la generación de contraseñas no a partir de programas ya que esto conlleva a tener problemas de seguridad por parte de los usuarios, sino a establecer el uso de políticas que permitan la generación de claves seguras y con un alto grado de usabilidad por parte de quien las va a utilizar.…”

Section: Introductionunclassified

“…Sin embargo, existe otra mirada como se observa en varias publicaciones de revistas científicas tipo A como la IEEE y ACM según estudios como [8] [15], centrados en la generación de contraseñas no a partir de programas ya que esto conlleva a tener problemas de seguridad por parte de los usuarios, sino a establecer el uso de políticas que permitan la generación de claves seguras y con un alto grado de usabilidad por parte de quien las va a utilizar.…”

Section: Introductionunclassified

Política De Gestión De Contraseñas Para Usuarios Finales

Echeverry

Sánchez

2016

Sci. tech

View full text Add to dashboard Cite

Resumen-Este artículo contiene el ciclo de vida de una contraseña, que va desde la generación hasta su tiempo de expiración. Adicionalmente, se presenta una política de gestión de contraseñas que contiene las pautas necesarias para generar e implementar claves seguras para el usuario final manteniendo su usabilidad, con el objetivo de mejorar la seguridad de los sistemas de información y capacitar a estos usuarios en cuanto a la protección de los datos de la organización.Palabras clave-Clave, contraseña, ciclo de vida de las contraseñas, política de gestión de contraseñas, usuario final.Abstract-This article contains the life cycle of a password that begins since the generation until its expiration time. Additionally, It is presented a password management policy which contains the necessary guidelines to generate and implement the use of safe passwords for the end-user maintaining its usability, with the objective of improve the security of the information systems and train these users with topics related to the data protection of the organization.Key Word -cycle life of a password, End-user, password, password management policy. I. INTRODUCCIÓNLos métodos de autenticación se dividen en tres grandes categorías en función de lo que utilizan para la verificación de identidad, las cuales son: (a) algo que el usuario sabe (contraseña), (b) algo que éste posee (tarjeta inteligente), y (c) una característica física del usuario. El ciclo de vida de las contraseñas como se define en la figura 1, consta de una serie de etapas que van desde la generación hasta la terminación de la clave.El problema que se presenta es que a pesar de que actualmente se cuenta con herramientas para la generación de contraseñas como "Random Password Generator" [7] [15], centrados en la generación de contraseñas no a partir de programas ya que esto conlleva a tener problemas de seguridad por parte de los usuarios, sino a establecer el uso de políticas que permitan la generación de claves seguras y con un alto grado de usabilidad por parte de quien las va a utilizar.

show abstract