Skeptic: Automatic, Justified and Privacy-Preserving Password Composition Policy Selection
Saul Johnson, Jo\~ao F. Ferreira, Alexandra Mendes, Julien, Cordry

TL;DR
Skeptic is a novel methodology and toolkit that automatically selects the most effective password composition policy by analyzing large password datasets and simulating user behaviors to enhance password security.
Contribution
This work introduces a new approach using password probability distributions and power-law fitting to justify password policies without needing user data or extensive studies.
Findings
Aligns closely with previous empirical studies on password policy effectiveness.
Demonstrates the ability to justify policies without direct access to user passwords.
Validates the approach using over 200 million passwords across multiple datasets.
Abstract
The choice of password composition policy to enforce on a password-protected system represents a critical security decision, and has been shown to significantly affect the vulnerability of user-chosen passwords to guessing attacks. In practice, however, this choice is not usually rigorous or justifiable, with a tendency for system administrators to choose password composition policies based on intuition alone. In this work, we propose a novel methodology that draws on password probability distributions constructed from large sets of real-world password data which have been filtered according to various password composition policies. Password probabilities are then redistributed to simulate different user password reselection behaviours in order to automatically determine the password composition policy that will induce the distribution of user-chosen passwords with the greatest…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
