A state-of-the-art password meter that offers real-time feedback and advice to help people create better passwords has been developed by researchers from Carnegie Mellon University and the University of Chicago.
One of the most popular passwords in 2016 was “qwertyuiop,” even though most password meters will tell you how weak that is. Many existing meters also fail to offer good advice on how to make it better until.
The team conducted an online study in which they asked 4,509 people to use their new tool to create a password.
“Instead of just having a meter say, ‘Your password is bad,’ we thought it would be useful for the meter to say, ‘Here’s why it’s bad and here’s how you could do better,’” said Nicolas Christin, a professor at Carnegie Mellon, and co-author of the study.
“The key result is that providing the data-driven feedback actually makes a huge difference in security compared to just having a password labelled as weak or strong,” said Blase Ur, the study’s lead author.
“Our new meter led users to create stronger passwords that were no harder to remember than passwords created without the feedback.”
The meter works by employing an artificial neural network: a large, complex map of information that resembles the way neurons behave in the brain.
The team conducted a study about this neural network approach which “learns” by scanning millions of existing passwords and identifying trends. If the meter detects a characteristic in your password that it knows attackers may guess, it’ll tell you.
“The way attackers guess passwords is by exploiting the patterns that they observe in large datasets of breached passwords,” Ur said. “For example, if you change Es to 3s in your password, that’s not going to fool an attacker. The meter will explain about how prevalent that substitution is and offer advice on what to do instead.”
This data-driven feedback is presented in real-time, as a user is typing their password out letter-by-letter.
The team has open-sourced their meter on GitHub.
“There’s a lot of different tweaking that one could imagine doing for a specific application of the meter,” Ur said. “We’re hoping to do some of that ourselves and also engage other members of the security and privacy community to help contribute to the meter.”
Last month a study found that PINs and passwords for smartphones can be accessed by hackers just by monitoring the way a mobile phone tilts while being held.