Improving Password Generation Through the Design of a Password Composition Policy...
summary
Designs a JSON-based password composition policy language that encodes 270 unique real-world PCPs (scraped from an initial 626 sites), adding features until every policy is expressible: custom character sets, min/max and consecutive-character limits, required and prohibitive locations, and multiple rule sets. Ships Python and JavaScript libraries on pip/npm and a Bitwarden prototype that fetches site PCPs and generates compliant passwords. A 25-person novice developer study shows near-perfect correctness (most tasks 30s–4.5min; one complex policy caused most errors). Analysis finds ~50% of PCPs still fail to resist offline attacks once human character preferences are considered.
AI-written summary · about
chapters (10)
- 0:00Password manager challenges
- 1:04PCB description language goals
- 2:09Password composition policies
- 3:57PCB language features
- 4:41Password validation with PCB
- 5:24Password strength and preferences
- 6:31Usability study results
- 7:34Comparison with prior research
- 8:16Password security analysis
- 9:21Key findings and recommendations
related talks
27mThe Wide Diversity of Password Requirements – And how to cope with it
28mRandom Passwords Aren't Good Enough
47mYour Password Complexity Requirements are Worthless
05mPlease do not use !?_ or your License Plate Number: Analyzing Password Policies in
19mDesign and Evaluation of a Data-Driven Password Meter
24mUsability vs. Security. Can they live together?
30mhunter2: A Symphony of Password Horror
40mFantastic Passwords and Where to Find Them