From Very Weak to Very Strong: Analyzing Password-Strength Meters

Abstract

Millions of users are exposed to password-strength meters/checkers at highly popular web services that use userchosen passwords for authentication. Recent studies have found evidence that some meters actually guide users to choose better passwords-which is a fairly rare-bit of good news in password research. However, these meters are mostly based on ad-hoc design. At least, as we found, most vendors do not provide any explanation of their design choices, sometimes making them appear to be a black box. We analyze password meters deployed in selected popular websites, by measuring the strength labels assigned to common passwords from several password dictionaries. From this empirical analysis with millions of passwords, we report prominent characteristics of meters as deployed at popular websites. We shed light on how the server-end of some meters functions, provide examples of highly inconsistent strength outcomes for the same password in different meters, along with examples of many weak passwords being labeled as strong or even very strong. These weaknesses and inconsistencies may confuse users in choosing a stronger password, and thus may weaken the purpose of these meters. On the other hand, we believe these findings may help improve existing meters, and possibly make them an effective tool in the long run.

PSV (Password Security Visualizer): From Password Checking to User Education

“…The same observations were reported by de Carné de Carnavalet and Mannan in their work [3], in which they examined 13 PPCs deployed at 11 widely-used web services.…”

“…Using purely client-side Web-based technologies, we implemented one possible PSV design as an open-source software tool on a 2-D animated canvas. We followed some educational principles to design and 3 In principle, a PSM algorithm can return more than one value each representing a different aspect of the password strength. Such algorithms are however very rare.…”

Who Are You? A Statistical Approach to Measuring User Authenticity

“…Historically, the strength of passwords against guessing attacks has been assessed by using password crackers to find weak passwords [42]. Recently much more precise techniques have been developed [8], [50], [13], [18], [22].…”

A model counter for constraints over unbounded strings

“…In analysis of real programs, these constraints could be much more complex. For instance, the targeted password could have additional strength requirements imposed [24] or the guess could be computed using automated rules by a tool [49]. Encoding such constraints may yield a complex set of constraints in the analysis.…”

“…We demonstrate the use of SMC to quantify the sensitive information leaked in several UNIX utilities when they operate on encrypted data as proposed in a recent work [46]. As a final case study, we use SMC to quantitatively compare the strength of three password meters in real-world websites -Ebay, Drupal and Microsoft, and measure their efficacy in preventing passwords that are known dictionary words [24].…”