Analyzing the Patterns of Numbers in 10M Passwords (2015)

Re:Analyzing the Patterns of Numbers in 10M Passwords (2015) by TorKlingberg on Thursday October 13, 2016 @10:22AM (#12700946)

I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwords.

Even if you force users to pick a password of at least 8 characters with upper and lower case letter, numbers and special characters, I suspect the real entropy is much lower than the theoretical.

[ Parent | on HN ]

Re:Analyzing the Patterns of Numbers in 10M Passwords (2015) by e12e on Thursday October 13, 2016 @11:24AM (#12701331)

There were a couple of talks about this at password^12:

Like:

http://passwords12.at.ifi.uio.no/Kirsi_Helkala/

http://passwords12.at.ifi.uio.no/Markus_Duermuth_Password_Se...

But it's a whole conference about passwords... so not sure if I found the presentation I had in mind...:

http://passwords12.at.ifi.uio.no/

And btw, registration is now open for password^16 in Germany in December: https://passwordscon.org/

[ Parent | on HN ]

Re:Analyzing the Patterns of Numbers in 10M Passwords (2015) by PwdRsch on Friday October 14, 2016 @02:26PM (#12710121)

Some of the latest research on this technique:

Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks https://www.ece.cmu.edu/~lbauer/papers/2016/usenixsec2016-ne...

[ Parent | on HN ]

Re:Analyzing the Patterns of Numbers in 10M Passwords (2015) by andromeduck on Thursday October 13, 2016 @11:24AM (#12701327)

That had been done for more than a decade now.

[ Parent | on HN ]