Sciweavers

Share
CCS
2010
ACM

The security of modern password expiration: an algorithmic framework and empirical analysis

8 years 7 months ago
The security of modern password expiration: an algorithmic framework and empirical analysis
This paper presents the first large-scale study of the success of password expiration in meeting its intended purpose, namely revoking access to an account by an attacker who has captured the account's password. Using a dataset of over 7700 accounts, we assess the extent to which passwords that users choose to replace expired ones pose an obstacle to the attacker's continued access. We develop a framework by which an attacker can search for a user's new password from an old one, and design an efficient algorithm to build an approximately optimal search strategy. We then use this strategy to measure the difficulty of breaking newly chosen passwords from old ones. We believe our study calls into question the merit of continuing the practice of password expiration. Categories and Subject Descriptors K.6.5 [MANAGEMENT OF COMPUTING AND INFORMA
Yinqian Zhang, Fabian Monrose, Michael K. Reiter
Added 06 Dec 2010
Updated 06 Dec 2010
Type Conference
Year 2010
Where CCS
Authors Yinqian Zhang, Fabian Monrose, Michael K. Reiter
Comments (0)
books