Login | Register

From Very Weak to Very Strong: Analyzing Password-Strength Meters


From Very Weak to Very Strong: Analyzing Password-Strength Meters

de Carné de Carnavalet, Xavier and Mannan, Mohammad (2014) From Very Weak to Very Strong: Analyzing Password-Strength Meters. In: Network and Distributed System Security (NDSS) Symposium 2014. (In Press)

This is the latest version of this item.

Text (Extended version of an NDSS2014 paper) (application/pdf)
password-meters-tech.pdf - Accepted Version
Available under License Spectrum Terms of Access.


Millions of users are exposed to password-strength meters/checkers at highly popular web services that use user- chosen passwords for authentication. Recent studies have found evidence that some meters actually guide users to choose better passwords—which is a fairly rare-bit of good news in password research. However, these meters are mostly based on ad-hoc design. At least, as we found, most vendors do not provide any explanation of their design choices, sometimes making them appear to be a black box. We analyze password meters deployed in selected popular websites, by measuring the strength labels assigned to common passwords from several password dictionaries. From this empirical analysis with millions of passwords, we report prominent characteristics of meters as deployed at popular websites. We shed light on how the server-end of some meters functions, provide examples of highly inconsistent strength outcomes for the same password in different meters, along with examples of many weak passwords being labeled as strong or even very strong. These weaknesses and inconsistencies may confuse users in choosing a stronger password, and thus may weaken the purpose of these meters. On the other hand, we believe these findings may help improve existing meters, and possibly make them an effective tool in the long run.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Conference or Workshop Item (Paper)
Authors:de Carné de Carnavalet, Xavier and Mannan, Mohammad
Journal or Publication:Network and Distributed System Security Symposium (NDSS 2014)
Date:February 2014
ID Code:978105
Deposited On:06 Jan 2014 16:37
Last Modified:18 Jan 2018 17:46

Available Versions of this Item

All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Back to top Back to top