Username-Password Models Beyond Traditional Password Guessability Assessment

Abstract

Passwords are widely used for website authentication, but they are vulnerable to guessing attacks. To measure password guessability, the commonly used approach involves modeling the distribution of passwords with a password probability model and then estimating the guessability using Monte Carlo methods based on the model. We found that users’ passwords are closely linked to their usernames. However, few password models proposed by previous research consider this connection, which significantly overestimates the security of passwords and can result in inadequate security measures, potentially leading to data breaches and financial losses. In this paper, we propose a new category of password model called username-password model, which models the conditional probability of passwords given usernames. We also provide an instance of the username-password model using Transformer (TUPM). The experimental results of guessing attacks show that TUPM outperforms other password models in terms of crack rate across any number of guesses (up to 10<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">20</sup>). Notably, TUPM cracks 100%–175% more passwords compared to the state-of-the-art models, within the first 1,000 guesses. This indicates that TUPM can provide a more accurate estimation of password guessability.