Fast, Lean, and Accurate: Modeling Password Guessability Using - - PowerPoint PPT Presentation

▶
fast lean and accurate modeling password guessability
SMART_READER_LITE
LIVE PREVIEW

Fast, Lean, and Accurate: Modeling Password Guessability Using - - PowerPoint PPT Presentation

Jan 23, 2023 20 likes •805 views

Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks William Melicher , Blase Ur, Sean Segreti, Saranga Komanduri, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor Guessing Methods 2 Guessing Methods John the

slide-1
SLIDE 1

Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks

William Melicher, Blase Ur, Sean Segreti, Saranga Komanduri, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor

slide-2
SLIDE 2

Guessing Methods

2

slide-3
SLIDE 3

Guessing Methods

  • John the Ripper
  • Hashcat

3

slide-4
SLIDE 4

Guessing Methods

  • John the Ripper
  • Hashcat

4

Dictionary word + Rules

slide-5
SLIDE 5

Guessing Methods

  • John the Ripper
  • Hashcat

5

Dictionary word + Rules password + append 2 digits

slide-6
SLIDE 6

Guessing Methods

  • John the Ripper
  • Hashcat

6

Dictionary word + Rules password + append 2 digits password11 password12 ...

slide-7
SLIDE 7

Guessing Methods

  • John the Ripper
  • Hashcat
  • Markov Models

7

slide-8
SLIDE 8

Guessing Methods

  • John the Ripper
  • Hashcat
  • Markov Models

8

p a s s t

...

e

slide-9
SLIDE 9

Guessing Methods

  • John the Ripper
  • Hashcat
  • Markov Models
  • PCFGs

9

slide-10
SLIDE 10

Guessing Methods

  • John the Ripper
  • Hashcat
  • Markov Models
  • PCFGs

10

L8D2 L6S2 password12 password11 ... monkey!! qwerty.. ... ...

slide-11
SLIDE 11

Guessing Methods

  • John the Ripper
  • Hashcat
  • Markov Models
  • PCFGs

11

slide-12
SLIDE 12
slide-13
SLIDE 13

Can we guess more accurately? Quicker? With fewer resources?

13

slide-14
SLIDE 14

Our Approach: Neural Networks

14

Hello = Здравствуйте Handwriting Recognition → Handwriting recognition

slide-15
SLIDE 15

Outline: Guessing with Neural Networks

  • How to guess passwords with neural networks
  • Password guesser design
  • Comparison to other guessing methods
  • Real-time, in-browser feedback with neural networks

15

slide-16
SLIDE 16

Generating Passwords

16

slide-17
SLIDE 17

Generating Passwords

17

passw

  • or maybe 0 or O or ...
slide-18
SLIDE 18

Generating Passwords

18

passw

Next char is: A: 3% B: 1% C: 0.6% … O: 55% … Z: 0.01% 0: 20% 1: ...

slide-19
SLIDE 19

Generating Passwords

19

“” Prob: 100%

slide-20
SLIDE 20

Generating Passwords

20

Next char is: A: 3% B: 2% C: 5% … O: 2% … Z: 0.2% 0: 1% 1: … END: 2%

“” Prob: 100%

slide-21
SLIDE 21

Generating Passwords

21

Next char is: A: 3% B: 2% C: 5% … O: 2% … Z: 0.2% 0: 1% 1: … END: 2%

“” Prob: 100%

slide-22
SLIDE 22

Generating Passwords

22

“” Prob: 100%

Next char is: A: 3% B: 2% C: 5% … O: 2% … Z: 0.2% 0: 1% 1: … END: 2%

slide-23
SLIDE 23

Generating Passwords

23

“C” Prob: 5%

slide-24
SLIDE 24

Generating Passwords

24

Next char is: A: 10% B: 1% C: 4% … O: 8% … Z: 0.02% 0: 3% 1: … END: 6%

“C” Prob: 5%

slide-25
SLIDE 25

Generating Passwords

25

Next char is: A: 10% B: 1% C: 4% … O: 8% … Z: 0.02% 0: 3% 1: … END: 6%

“C” Prob: 5%

slide-26
SLIDE 26

Generating Passwords

26

“CA” Prob: 0.5%

Next char is: A: 3% B: 10% C: 7% … O: 1% … Z: 0.03% 0: 2% 1: … END: 12%

slide-27
SLIDE 27

Generating Passwords

27

“CAB” Prob: 0.05%

Next char is: A: 3% B: 10% C: 7% … O: 1% … Z: 0.03% 0: 2% 1: … END: 3%

slide-28
SLIDE 28

Generating Passwords

28

“CAB” Prob: 0.05%

Next char is: A: 4% B: 3% C: 1% … O: 2% … Z: 0.01% 0: 4% 1: … END: 12%

slide-29
SLIDE 29

Generating Passwords

29

“CAB” Prob: 0.05%

Next char is: A: 4% B: 3% C: 1% … O: 2% … Z: 0.01% 0: 4% 1: … END: 12%

slide-30
SLIDE 30

Generating Passwords

30

“CAB” Prob: 0.006%

slide-31
SLIDE 31

Generating Passwords

31

CAB - 0.006% CAC - 0.0042% ADD1 - 0.002% CODE - 0.0013% ...

slide-32
SLIDE 32

Generating Passwords

32

CAB - 0.006% CAC - 0.0042% ADD1 - 0.002% CODE - 0.0013% ...

Must be longer than 3 characters

slide-33
SLIDE 33

Password Policies: 1class8

1 character class and 8 characters minimum password123 12345678 monkey99

33

slide-34
SLIDE 34

Password Policies: 4class8

4 character classes and 8 characters minimum Pa$$w0rd !Qaz2wsx Jvj24601!

34

slide-35
SLIDE 35

Password Policies: 1class16

1 character class and 16 characters minimum 123456789123456789 qwertyuiop123456 Monika1234567890

35

slide-36
SLIDE 36

Password Policies: 3class12

3 character class and 12 characters minimum llamalove123 Mypassword#3 N@rut0_r0ck5

36

slide-37
SLIDE 37

Outline: Guessing with Neural Networks

  • How to guess passwords with neural networks
  • Password guesser design
  • Comparison to other guessing methods
  • Real-time, in-browser feedback with neural networks

37

slide-38
SLIDE 38

Design Space

38

slide-39
SLIDE 39

Design Space

  • Model size

3MB - Browser 60MB - Limited by GPU

39

slide-40
SLIDE 40

Design Space

  • Model size
  • Transference learning

40

1class8 network 3class12 network Transfer knowledge

slide-41
SLIDE 41

Design Space

  • Model size
  • Transference learning
  • Training data

Natural language? Varying training sets?

41

slide-42
SLIDE 42

Design Space

  • Model size
  • Transference learning
  • Training data
  • Model architecture
  • Alphabet size
  • Password context

42

slide-43
SLIDE 43

Testing Methodology

  • Approach: measure # guessed passwords
  • Training data: leaked password sets
  • Testing data

○ MTurk study passwords: 1class8, 4class8, 1class16, 3class12 ○ Real passwords: 000webhost password leak

  • Use Monte-Carlo to estimate guess numbers

(Dell’Amico and Filippone CCS ‘15)

43

slide-44
SLIDE 44

44

Tuning Training

slide-45
SLIDE 45

45

slide-46
SLIDE 46

46

slide-47
SLIDE 47

47

slide-48
SLIDE 48

48

More accurate guessing

slide-49
SLIDE 49

49

More accurate guessing

slide-50
SLIDE 50

Transference Learning → More Accurate

50

15% → 22%

slide-51
SLIDE 51

Natural Language Doesn’t Help

51

slide-52
SLIDE 52

Model Size: Larger Is More Accurate

52

slide-53
SLIDE 53

Model Size: Larger Is More Accurate

53

slide-54
SLIDE 54

Model Size: Larger Is More Accurate

54

slide-55
SLIDE 55

Model Size: Larger Is More Accurate

55

Sometimes

slide-56
SLIDE 56

56

Comparison to Other Approaches

slide-57
SLIDE 57

1class8: Comparison

57

slide-58
SLIDE 58

1class8: Neural Networks Guess Better

58

slide-59
SLIDE 59

1class8: Neural Networks Guess Better

59

slide-60
SLIDE 60

4class8: Neural Networks Guess Better

60

slide-61
SLIDE 61

3class12: Neural Networks Guess Better

61

slide-62
SLIDE 62

3class12: Neural Networks Guess Better

62

30% → 45%

slide-63
SLIDE 63

Password feedback:

63

slide-64
SLIDE 64

Current password feedback: Quick or accurate

64

slide-65
SLIDE 65

Accurate Guessing Methods

100s MB to GBs!

65

slide-66
SLIDE 66

Accurate Guessing Methods

100s MB to GBs!

66

slide-67
SLIDE 67

Accurate Guessing Methods

100s MB to GBs!

67

Neural networks: 60MB, 3MB

slide-68
SLIDE 68

Accurate Guessing Methods

68

Neural networks: 60MB, 3MB

?

slide-69
SLIDE 69

Accurate Guessing Methods

69

Hours to days!

slide-70
SLIDE 70

Can neural networks give real-time feedback?

70

slide-71
SLIDE 71

Ideal Meter Targets

  • Small: < 1MB
  • Fast: < 0.1 sec
  • JavaScript
  • Accurate

71

slide-72
SLIDE 72

Making Meters Small

  • Start with small version of neural network
  • Quantize parameters of model
  • Compress with existing lossless compression methods

72

850KB < 1MB

slide-73
SLIDE 73

Making Meters Fast

  • Pre-compute inexact mapping from prob → guess number
  • Cache intermediate results
  • Run on separate thread

73

17 ms < 0.1 sec

slide-74
SLIDE 74

Meter Accuracy

74

slide-75
SLIDE 75

Meter Accuracy

75

slide-76
SLIDE 76

Meter Accuracy

76

slide-77
SLIDE 77

Meter Accuracy

77

slide-78
SLIDE 78

Modeling Passwords Using Neural Networks

  • Neural networks guess passwords accurately
  • Can be made small and fast for client-side feedback

github.com/cupslab

78

William Melicher, Blase Ur, Sean M. Segreti, Saranga Komanduri, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor