The weak and the strong password preferences

Abstract

Considering the computer authentication, any password shall not only be private to its owner but also be chosen as not to be predicted easily by others. The passwords used in authentication processes of any critical system should be strong as not to be cracked easily. In this context, the strong password choice gets significance for the general system security. This study aims to reveal the proper and improper properties on password preferences via examining the real samples. The method used in this work is first to gather the real passwords in plaintext, then to crack the encrypted forms of them and finally to investigate statistical queries on those passwords in order to distinguish the common weak and strong characteristics. As the case study, the experiments are conducted on real passwords of Turkish users in an actively running system. The results of the experiments are categorized for weak and strong passwords. Moreover, the common tendencies on password choice are evaluated.

Strong passwords: Practical issues

“…For hackers, however, this is very important because they can use a brute force attack easily. Base on this, a time-effective approach is to think about the candidates that are to be the actual words, patterns, or combination of the characters, which are not difficult to remember [6].…”

“…The target of hacking tools is two object: passwords and the function for administrators to reactively check the passwords used in the system. The reactive checking may increase the system security by finding the easy to hack passwords and by warning the related uses to change their passwords to prevent their accounts from being cracked by intruders [6]. John the Ripper and Hashcat [8], [9] are the tools to do the analysis and provide information on methods used by hackers.…”

“…A goal of this survey was to get the information on password usage by unprofessional security users. We summarize the results of discussions by using survey data and data from others sources [6], [10]- [13].…”

“…It means third year students have more variations in password length compared to second year students. Study [6] shows the relationship between the password length and strength of passwords. The portion of the strong passwords with the length of 7 characters has a proportion of 96 % among the whole passwords.…”

“…About 50% of characters in the passwords are in lower-case. Study [6] reveals another tendency in creation of passwords that the users also prefer to include uppercase characters in the passwords. One important issue from this data is that passwords containing at least one punctuation character such as , ", !, &, <, > etc are not used often but the probability to hack them is very low.…”