Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks
summary
Neural networks generate password guesses that beat PCFGs and Markov models, often improving success by roughly 50% at high guess counts (e.g., 15%→22% at 10^15 guesses, ~30%→~45% at 10^16). Models tested at 3 MB and 60 MB sizes; aggressive quantization plus gzip compresses a practical model to ~850 KB. A JavaScript client runs the compressed model with sub-second latency (common-case ~17 ms) and provides principled, real-time strength estimates for arbitrary attack budgets.
AI-written summary · about
chapters (17)
- 0:00Intro
- 4:06Our Approach: Neural Networks
- 4:37Outline: Guessing with Neural Networks
- 5:05Generating Passwords
- 8:11Password Policies: 1 class
- 9:24Design Space
- 12:17Testing Methodology
- 13:51Transference Learning - More Accurate
- 14:13Natural Language Doesn't Help
- 16:041class8: Neural Networks Guess Better
- 16:493class 12: Neural Networks Guess Better
- 18:20Accurate Guessing Methods
- 19:35Ideal Meter Targets
- 20:25Making Meters Small
- 21:08Making Meters Fast
- 21:51Meter Accuracy
- 22:39Modeling Passwords Using Neural Networks
related talks
19mDesign and Evaluation of a Data-Driven Password Meter
26m“bluegiraffeplaysball” or Make Passwords Great Again Using zxcvbn
28mRandom Passwords Aren't Good Enough
14mPasswords. Are. Not. Hard!
27mKeeping passwords safe in 2017
40mLive autopsy of a password: lessons learnt cracking secrets
19mForgetting of Passwords: Ecological Theory and Data
43mPlease pass the salt: Serve up passwords with a side of entropy