25th USENIX Security Symposium has ended
Back To Schedule
Wednesday, August 10 • 2:30pm - 3:00pm
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Human-chosen text passwords, today’s dominant form of authentication, are vulnerable to guessing attacks. Unfortunately, existing approaches for evaluating password strength by modeling adversarial password guessing are either inaccurate or orders of magnitude too large and too slow for real-time, client-side password checking. We propose using artificial neural networks to model text passwords’ resistance to guessing attacks and explore how different architectures and training methods impact neural networks’ guessing effectiveness. We show that neural networks can often guess passwords more effectively than state-of-the-art approaches, such as probabilistic context-free grammars and Markov models. We also show that our neural networks can be highly compressed—to as little as hundreds of kilobytes— without substantially worsening guessing effectiveness. Building on these results, we implement in JavaScript the first principled client-side model of password guessing, which analyzes a password’s resistance to a guessing attack of arbitrary duration with sub-second latency. Together, our contributions enable more accurate and practical password checking than was previously possible.


Lujo Bauer

Carnegie Mellon University

Nicolas Christin

Carnegie Mellon University

Lorrie Faith Cranor

Carnegie Mellon University

Saranga Komanduri

Carnegie Mellon University

William Melicher

Carnegie Mellon University

Sean M. Segreti

Sean is a PhD student at Carnegie Mellon University, where he conducts and publishes studies on password security and usability. He and Blase Ur will be representing the entire passwords research group at CMU, which comprises three faculty and more than 10 students.
avatar for Blase Ur

Blase Ur

Assistant Professor, University of Chicago

Wednesday August 10, 2016 2:30pm - 3:00pm PDT
Zilker Ballroom 3

Attendees (4)