An investigation of semantic patterns in passwords

The advent of large password leaks in recent years has exposed the security problems of passwords and enabled deeper empirical investigation of password patterns. Researchers have only touched the surface of patterns in password creation, having characterized patterns in terms of frequency, length, composition rules and, to some extent, syntactic patterns. The semantics of passwords remain largely unexplored. In this thesis, we aim to fill this gap by employing Natural Language Processing techniques to extract and leverage understanding of semantic patterns in passwords. We present the first framework for segmentation, semantic classification and semantic generalization of passwords and a model that captures the semantic essence of password samples. The results of our investigation demonstrate that the knowledge captured by our model can be used to crack more passwords than the state-of-the-art approach. In experiments limited to 3 billion guesses, our approach can guess 67% more passwords from the LinkedIn leak and 32% more passwords from the MySpace leak. Furthermore, we explore the implications of using date patterns in guessing attacks and investigate the lexical differences between standard English and the language used in passwords.

Name thesis:degree_name

Master of Science (MSc)

Discipline thesis:degree_discipline

Electrical and Computer Engineering

Grantor

University of Ontario Institute of Technology

Year dc:date.issued

2013

Author dc:creator

• Veras Guimaraes, Rafael

Advisors dc:contributor.advisor

• Collins, Christopher
• Thorpe, Julie

• Security
• Passwords
• Authentication
• Semantics
• Guessing

Language dc:language.iso

en

Handle dc:identifier.uri

https://hdl.handle.net/10155/331

OAI identifier oai:identifier

oai:ontariotechu.scholaris.ca:10155/331