A study on strength estimation of non-English and non-ASCII passwords
For decades, text-based passwords have been the primary means of authentication to computer systems, as well as account security and disk encryption. Thus, in order to prevent users from selecting passwords that are too easy for an adversary to crack, password composition policies and password stren...
Αποθηκεύτηκε σε:
| Κύριοι συγγραφείς: | , |
|---|---|
| Άλλοι συγγραφείς: | |
| Γλώσσα: | English |
| Δημοσίευση: |
2021
|
| Θέματα: | |
| Διαθέσιμο Online: | http://hdl.handle.net/11610/21462 |
| Ετικέτες: |
Προσθήκη ετικέτας
Δεν υπάρχουν, Καταχωρήστε ετικέτα πρώτοι!
|
| Περίληψη: | For decades, text-based passwords have been the primary means of authentication to computer systems, as well as account security and disk encryption. Thus, in order to prevent users from selecting passwords that are too easy for an adversary to crack, password composition policies and password strength meters have been widely studied and adopted. Research has already shown that certain password composition policies and password strength meters fulfill this purpose and perform better than others. However, we believe that these results are biased when it comes to scoring non-English passwords, even for password strength meters who seemingly contribute to the creation of stronger passwords, because the majority of them is based on leaked password sets of English speaking users as their training base.
In this dissertation, we study modern password-strength meters as well as their accuracy and effect. Furthermore, we turn our attention on the ways an attacker can carry out a targeted password guessing attack, taking advantage of the nationality of the users. We train two modern password strength meters with a Greeklish training set, and try to prove our initial belief that they tend to falsely score non-English passwords as strong, focusing specifically on Greeklish passwords. We also analyze non-ASCII character passwords to find out if they actually provide any additional levels of security. Finally, we show how modern password cracking tools perform against such passwords, while trying to crack passwords that contain letters from the Greek alphabet.
A few studies, based on determining the actual strength of non-English passwords as well as the password creation habits of non-English users, especially Chinese, have been carried out in the past. To our knowledge, however, this is the first study that focuses entirely on the strength of Greeklish passwords, i.e. passwords that contain Greek words transcribed in English, and not simply passwords created by Greek users. |
|---|