An Alternative Method for Understanding User-Chosen Passwords

Abstract EN

We present in this paper an alternative method for understanding user-chosen passwords.

In password research, much attention has been given to increasing the security and usability of individual passwords for common users.

Few of them focus on the relationships between passwords; therefore we explore the relationships between passwords: modification-based, similarity-based, and probability-based.

By regarding passwords as vertices, we shed light on how to transform a dataset of passwords into a password graph.

Subsequently, we introduce some novel notions from graph theory and report on a number of inner properties of passwords from the perspective of graph.

With the assistance of Python Graph-tool, we are able to visualize our password graph to deliver an intuitive grasp of user-chosen passwords.

Five real-world password datasets are used in our experiments to fulfill our thorough experiments.

We discover that (1) some passwords in a dataset are tightly connected with each other; (2) they have the tendency to gather together as a cluster like they are in a social network; (3) password graph has logarithmic distribution for its degrees.

Top clusters in password graph could be exploited to obtain the effective mangling rules for cracking passwords.

Also, password graph can be utilized for a new kind of password strength meter.