Investigating the Distribution of Password Choices

Abstract

In this paper we will look at the distribution with which passwords are chosen. Zipf's Law is commonly observed in lists of chosen words. Using password lists from four different on-line sources, we will investigate if Zipf's law is a good candidate for describing the frequency with which passwords are chosen. We look at a number of standard statistics, used to measure the security of password distributions, and see if modelling the data using Zipf's Law produces good estimates of these statistics. We then look at the the similarity of the password distributions from each of our sources, using guessing as a metric. This shows that these distributions provide effective tools for cracking passwords. Finally, we will show how to shape the distribution of passwords in use, by occasionally asking users to choose a different password.

References in corpus (1)

• Power-law distributions in empirical data

Cited by in corpus (13)

• Guesswork, large deviations and Shannon entropy
• On the Economics of Offline Password Cracking
• Multi-user guesswork and brute force security
• Skeptic: Automatic, Justified and Privacy-Preserving Password Composition Policy Selection
• DALock: Distribution Aware Password Throttling
• Exploring the Impact of Password Dataset Distribution on Guessing
• Bernoulli honeywords
• Protecting Public OSN Posts from Unintended Access
• SemanticLock: An authentication method for mobile devices using semantically-linked images
• On Designing A Questionnaire Based Legacy-UI Honeyword Generation Approach For Achieving Flatness
• Passlab: A Password Security Tool for the Blue Team
• Towards a Rigorous Statistical Analysis of Empirical Password Datasets
• Multi-armed bandit approach to password guessing