2

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs.

At an extreme end, with a password history of wildcats, wildcats1, then wildcats2, I'd guess there is less than 1 bit of entropy in their next answer.

At the other extreme end, someone with randomly generated passwords would lose no information in their history. From an information-theoretic point of view, I imagine this is something we can estimate using the large amounts of password history data available in the world.

Somewhere in the middle, a history of "wildcats!Reddit", "crazydogs!Facebook", "locobirds!Stackexchange" would give me some good ideas for a Twitter password, and would greatly reduce the entropy of their hash. Of course, this would be related to the concept of password strength.

I'm not so well-read on security, but I assume my idea is not unique. Is there a name for this concept? Do we know any real-world values for the amount of information gained / entropy lost?

Improve this question
3
  • I'm a little unclear on what you're looking for. Are you looking for info on what percentage of users, on average, choose sequential passwords with predictable variations? Or something like the average Levenshtein distance between sequential passwords?
    – PwdRsch
    Jun 21, 2019 at 21:04
  • No, but I don't know how to modify my answer to be more clear. With an alphabet of 64 characters, the entropy per character of a password is probably less than 6 bits, because humans do not pick passwords uniformly random. I.e. we have information about the distribution of passwords. We can then quantify password strength or entropy given this information. Why stop there? If we know other passwords that a specific person has used, then we have more information to use, and have probably reduced the password strength further. Surely this is not an original idea?
    – lynn
    Jun 23, 2019 at 1:07
  • I imagine it would take a research paper to actually give you any kind of answer.
    – forest
    Jun 23, 2019 at 5:08

1 Answer 1

Reset to default
0

Answering my own question a few months later -- it turns out there is some (very recent) research here.

Beyond Credential Stuffing: Password Similarity Models using Neural Networks by Bijeeta Pal et. al. introduces some work that cracks passwords by using a users other known passwords, and introduces the concept of a "personal password meter"

I'm not an expert here, but this looks like an interesting first reading. The citations are especially useful, and link to some related works.

As far as I know, as of now (Nov 2019) there aren't any ready-to-use tools like JackTheRipper or HashCat to do this.

Improve this answer
1
  • 1
    The concept still is "entropy". The thing to study is the range of choice made for each character. That's easy to calculate and model.
    – schroeder ♦
    Nov 13, 2019 at 23:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .