Modified Password Guessing Methods Based on TarGuess-I

Abstract

TarGuess − I is a leading online targeted password guessing model using users’ personally identifiable information (PII) proposed at ACM CCS 2016 by Wang et al. It has attracted widespread attention in password security owing to its superior guessing performance. Yet, after analyzing the users’ vulnerable behaviors of using popular passwords and constructing passwords with users’ PII, we find that this model does not take into account popular passwords, keyboard patterns, and the special strings. The special strings are the strings related to users but do not appear in the users’ demographic information. Thus, we propose TarGuess − I + K P X , a modified password guessing model with three semantic methods, including (1) identifying popular passwords by generating top-300 lists from similar websites, (2) recognizing keyboard patterns by relative position, and (3) catching the special strings by extracting continuous characters from user-generated PII. We conduct a series of evaluations on six large-scale real-world leaked password datasets. The experimental results show that our modified model outperforms TarGuess − I by 2.62% within 100 guesses.

Building a Multi-class Password Strength Generator and Classifier Model by Augmenting Supervised Machine Learning Techniques

“…Some of the renowned tools are Password Meter (PM, 2008), Microsoft Password Checker (MPC, 2008), Google Password Meter (GPM, 2008), etc [3]. Also, few passwords guessing tools are also available such as HashCat, PassGAN [4], TarGuess I-IV [5] etc. Generally password guidelines are a low-cost solution to the problem of improving the security and usability of text-based passwords [6].…”