Password Exhaustion: Predicting the End of Password Usefulness

DMCA

Password Exhaustion: Predicting the End of Password Usefulness

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Luke St. Clair , Lisa Johansen , William Enck , Matthew Pirretti , Patrick Traynor , Patrick Mcdaniel , Trent Jaeger

Citations:

13 - 0 self

BibTeX

@MISC{Clair_passwordexhaustion:,
    author = {Luke St. Clair and Lisa Johansen and William Enck and Matthew Pirretti and Patrick Traynor and Patrick Mcdaniel and Trent Jaeger},
    title = {Password Exhaustion: Predicting the End of Password Usefulness},
    year = {}
}

OpenURL

Abstract

Passwords are currently the dominant authentication mechanism in computing systems. However, users are unwilling or unable to retain passwords with a large amount of entropy. This reality is exacerbated by the increasing ability of systems to mount offline attacks. In this paper, we evaluate the degree to which the previous statements are true and attempt to ascertain the point at which passwords are no longer sufficient to securely mediate authentication. In order to demonstrate this, we develop an analytical model for computation to understand the time required to recover random passwords. Further, an empirical study suggests the situation is much worse. In fact, we found that past systems vulnerable to offline attacks will be obsolete in 5-15 years, and our study suggests that a large number of these systems are already obsolete. We conclude that we must discard or fundamentally change these systems, and to that effect, we suggest a number of ways to prevent offline attacks. 1

Keyphrases

password usefulness password exhaustion offline attack past system random password empirical study analytical model dominant authentication mechanism large amount large number 5-15 year previous statement

DMCA