1. Password Patterns – An Analysis
Dr. Emin Islam Tatlı
Twitter: @eitatli
tatli@architectingsecurity.com
25 April 2012
1

2. Password Patterns – An Analysis
Overview
1. Password Fiasco (Leakage of more than 32 M plain text passwords)
2. Password Analysis - Imperva
3. Password Analysis – Password Patterns
4. Conclusion
2

3. Password Leakage
rockyou.com hacked
* Referenced from http://techcrunch.com
3

4. Password Leakage
rockyou.com plaintext password are online
4

5. Password Patterns
FTC fines RockYou
5

6. Password Analysis
Analysis of Imperva - Distribution
•Consumer Password Worst Practices:
http://www.imperva.com/docs/WP_Consumer_Password_Worst_Practices.pdf
6

7. Password Analysis
Analysis of Imperva – Key Findings
7

8. Password Analysis
Analysis of Imperva – Common Passwords
8

9. Password Patterns
Password Complexity
What about security of
z6iFk#rdlr vs. TØpsecret.
???
Randomly generated Consists of certain patterns
(e.g. dictionary word, ending
with “.”)
9

10. Password Patterns
The Analysis
• Dual and Triple Concatenation of [:alpha:], [:digit:] and [:punct:] characters
• Replacement of [:alpha:] => [:digit:] and [:punct:]
• Special patterns
• Frequency of the Symbols
10

11. Password Patterns
[:alpha:], [:digit:] and [:punct:] characters
11

12. Password Patterns
No Concatenation
12

13. Password Patterns
Dual Concatenation
13

14. Password Patterns
Dual Concatenation – cont.
14

15. Password Patterns
Triple Concatenation
15

16. Password Patterns
Replacement Pattern
16

17. Password Patterns
Some Special Patterns
17

18. Password Patterns
Frequency of the Symbols
18

19. Password Patterns
Password Cracking - Methods
• Brute-Force Attacks
• Dictionary Attacks
19

20. Password Patterns
Password Cracking – Tools - I
20

21. Password Patterns
Password Cracking – Tools - II
21

22. Password Patterns
The Results in Conclusion
•The most commonly used dual concatenation of alpha-digit-punct characters is
“alpha+digit” with 30%.
•The most commonly used triple concatenation of alpha-digit-punct characters is
“alpha+punct+digit” with 0.57%.
•Forthe replacement pattern, replacing the letter i or l with the number “1” is the
most commonly used pattern.
•The most commonly used special character is . (point).
•Password patterns might be the next generation of dictionary attacks.
•Do not choose and use any password based on a common pattern.
22

23. References
•PasswordPatterns:
http://www.architectingsecurity.com/2010/09/11/password-patterns/
23