Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Lost in Disclosure: On The Inference of Password Composition Policies

Saul Johnson, João Ferreira, Alexandra Mendes, Julien Cordry

TL;DR

Lost in Disclosure presents a practical approach to infer password composition policies from breached password datasets lacking explicit policy labels. It reframes policy inference as outlier detection over attributes such as $length$ and $digits$, operationalized via $mult(l)=\frac{cum(l+1)}{cum(l)}$ with a threshold $c=2$, and implemented in the pol-infer tool. Across real datasets (RockYou, Yahoo, 000webhost, LinkedIn) and synthetic tests (padding and formatting errors), the method recovers known minimum-length constraints and detects absence of certain requirements, corroborating prior literature while illustrating robustness to noise. This work enables safer, policy-agnostic use of password data for research and highlights practical steps for handling noisy disclosures in security datasets.

Abstract

Large-scale password data breaches are becoming increasingly commonplace, which has enabled researchers to produce a substantial body of password security research utilising real-world password datasets, which often contain numbers of records in the tens or even hundreds of millions. While much study has been conducted on how password composition policies (sets of rules that a user must abide by when creating a password) influence the distribution of user-chosen passwords on a system, much less research has been done on inferring the password composition policy that a given set of user-chosen passwords was created under. In this paper, we state the problem with the naive approach to this challenge, and suggest a simple approach that produces more reliable results. We also present pol-infer, a tool that implements this approach, and demonstrates its use in inferring password composition policies.

Lost in Disclosure: On The Inference of Password Composition Policies

TL;DR

Lost in Disclosure presents a practical approach to infer password composition policies from breached password datasets lacking explicit policy labels. It reframes policy inference as outlier detection over attributes such as and , operationalized via with a threshold , and implemented in the pol-infer tool. Across real datasets (RockYou, Yahoo, 000webhost, LinkedIn) and synthetic tests (padding and formatting errors), the method recovers known minimum-length constraints and detects absence of certain requirements, corroborating prior literature while illustrating robustness to noise. This work enables safer, policy-agnostic use of password data for research and highlights practical steps for handling noisy disclosures in security datasets.

Abstract

Large-scale password data breaches are becoming increasingly commonplace, which has enabled researchers to produce a substantial body of password security research utilising real-world password datasets, which often contain numbers of records in the tens or even hundreds of millions. While much study has been conducted on how password composition policies (sets of rules that a user must abide by when creating a password) influence the distribution of user-chosen passwords on a system, much less research has been done on inferring the password composition policy that a given set of user-chosen passwords was created under. In this paper, we state the problem with the naive approach to this challenge, and suggest a simple approach that produces more reliable results. We also present pol-infer, a tool that implements this approach, and demonstrates its use in inferring password composition policies.

Paper Structure

This paper contains 17 sections, 2 equations, 8 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Contribution
  3. Outline
  4. Related Work
  5. Methodology
  6. Results: Real Data
  7. The RockYou Set (2009)
  8. The Yahoo Set (2012)
  9. Inferring the Absence of Constraints
  10. The 000webhost Set (2015)
  11. The LinkedIn Set (2016)
  12. Results: Synthetic Data
  13. Intentional Padding
  14. Formatting Errors
  15. Conclusion
  16. ...and 2 more sections

Figures (8)

  • Figure 1: Passwords of different lengths $l$ in the RockYou set cubrilovich2009rockyou, plotted against $mult(l)$.
  • Figure 2: Passwords of different lengths $l$ in the Yahoo set gross2012yahoo, plotted against $mult(l)$.
  • Figure 3: Passwords containing different numbers of digits $d$ in the Yahoo set gross2012yahoo, plotted against $mult(d)$.
  • Figure 4: Passwords of different lengths $l$ in the 000webhost set osborne2015000webhost, plotted against $mult(l)$.
  • Figure 5: Passwords containing different numbers of digits $d$ in the 000webhost set osborne2015000webhost, plotted against $mult(d)$.
  • ...and 3 more figures