Evaluating the Accuracy of Password Strength Meters using Off-The-Shelf Guessing Attacks

David Pereira, João F. Ferreira, Alexandra Mendes
August 2020
PDF Project

Abstract

In this paper we measure the accuracy of password strength meters (PSMs) using password guessing resistance against off-the-shelf guessing attacks. We consider 13 PSMs, 5 different attack tools, and a random selection of 60,000 passwords extracted from three different datasets of real-world password leaks. Our results show that a significant percentage of passwords classified as strong were cracked, thus suggesting that current password strength estimation methods can be improved.

Type
Conference paper
Publication
In the 2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) – 5th International Workshop on Reliability and Security Data Analysis (RSDA)
Avatar
Computer Scientist

My research interests include software reliability, software verification, and formal methods applied to software engineering. I am also interested in interactive storytelling. For more details, see some of my projects or my selected (or recent) publications. More posts are available in my blog. Follow me on Twitter or add me on LinkedIn.