0

Trying to figure out the patterns of passwords. I'm new to ML, but was inspired by PassGan, a ML tool that generates sample passwords. The likelihood is low enough that it's not very useful for password cracking, but I'd like to take the technique and use it for password discovery.

My intention is to train a model to understand what a password is, then compare that against words found on services (Slack, File Shares, etc.) to detect instances of people being sloppy and leaving passwords where they shouldn't be.

My core assumptions are that passwords are far from random, and if analyzed appropriately many share a common pattern(s). This pattern could be used to identify and hopefully eradicate poor operational security practices.

Ideally, I'd like to choose something that evaluates words and provides a probability of that word being a password, then given the likely hood, I could have the application make some kind of a decision.

Is there an algorithm or model that works well for this kind of task? It's single dimensional data, I'd assume unsupervised learning is really the only approach.

Improve this question
4
  • 1
    Interesting idea but I have my doubts that a simple model will work. For one you have the problem of properly tokenizing the input first. But is "foobar!" the word "foobar" with end of sentence marker "!" or is it a potential password "foobar!"? Then, is there really a pattern in passwords in the first place or is it simply that most passwords are not real words (although many common ones like "password" actually are real, so expect lots of false positives). So I doubt that there is a simple model you can just use for this. Maybe get more input from experts at Data Science instead.
    – Steffen Ullrich
    Dec 12, 2019 at 6:55
  • You may not very familiar with cryptography or hash function. Modern passwords are always stored / checked by hash functions. Even if one character in the password changes, every bit of the whole digest (result of password hashing) has 50% (very near 50%) to change. In addition, modern password storage uses salting. Hence, there is not pattern of similar passwords. You'd better find the vulnerability of password storage implementation (different password platforms have different implementation methods), and find a practical angle to apply your ML.
    – TJCLK
    Dec 12, 2019 at 10:54
  • Steffen, I see your point about difficulty, but I think that the conceptualization of how to train such a ML model is very idiosyncratic to password research. We can steal from general concepts like 'stemming' of words, but it's the fact that it's hard to create algorithmic rules to do this that makes both a fair ML question and a fair password-cracking question, IMO. TJCLK, generating candidate password plaintexts is exactly how offline password-cracking attacks against salted and hashed passwords works.
    – Royce Williams
    Dec 22, 2019 at 2:25
  • @TJCLK "Modern passwords are always stored..." this seems an over-optimistic view of the world of password-storage! As I read the question, the OP's main goal is to train a system to detect when passwords haven't been stored as securely as they should be.
    – TripeHound
    Jan 21, 2020 at 11:17

1 Answer 1

Reset to default
1

This isn't a great answer, but right now I think it's probably the only one possible, because this is a remarkably challenging problem. I'll go over a little of why for the others playing along a home.

Humans generate passwords in a variety of idiosyncratic ways:

  • Some are so naive that there's no machine learning necessary ("password", "dragon", etc.)
  • Some of them are not straight single words, but very familiar to just about anyone who has had to pick a password that follows complexity requirements ("Spring2019!")
  • Others are difficult to parse until you understand the underlying method (keyboard walks like "qazwsxedc", initialisms from song lyrics, etc.)
  • Others are ambiguous (is "hearthandhome" derived from the base words "heart" and "hand", or "hearth" and "and"?)
  • And if a password is 100% randomly generated, there's no underlying 'algorithm' for a computer to figure out at all!

For human-generated password "algorithms" like the ones above, some are more difficult to emulate - starting from the same principles and generating similar passwords - than others. And going the other direction - taking an existing string and figuring out how the original creator of that password constructed it from its atomic components - is even more difficult. (This is probably why ML-based approaches seem so attractive.)

This is a hot area of research. Unsupervised learning may indeed be the only approach, but the tricky part is figuring out how to get decent training data at sufficient volume - if for no other reason that we can't usually ask the original password creator to explain their reasoning. (It's quite common to crack passwords by throwing the "kitchen sink" at a corpus of hashes, with a subset of the resulting passwords cracked even though we don't understand how the original password was created in the first place!)

Some breadcrumbs:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .