Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength metrics. The mentioned strong password policies are:
Each password you choose must be new and different.
Passwords must be memorized. If a password is written down, it must be locked up.
Passwords must be at least six characters long, and probably longer, depending on the size of the password’s character set.
Passwords must be replaced periodically.
Passwords must contain a mixture of letters (both upper- and lowercase), digits, and punctuation characters.
When it comes to building a user registering system with user-chosen password input, I want to provide some information about the strength of the password typed from the user (such as the three level results:
strong) to guild user to set an appropriate password. The website The Password Meter performs the similar function and the criteria including number of characters, the count of uppercase letters, the count of lowercase letters, the count of symbols, etc. However, to evaluate a password is strong enough is not easy. Even a password is complex enough as something like
@P3V;4sF!]9u;3G,, the strength may still be not high enough in the situation of re-using the password in multiple authentication sites.
Thus, my question is : Is there a robust benchmark / algorithm / method to determine password strength (maybe giving a password strength index) which consider not only the complexity of the password itself but also the similarity (distance) of the known passwords in leaked password databases or common password databases like 10k-most-common.txt on Github?
If I misunderstand something, please let me know.
Reference of experimental implementation