Security evaluation of passwords used on internet

Abstract

This paper presents results of empirical study of passwords really used on internet. These passwords were obtained during two data acquisitions in three years period. In this paper a method for the evaluation of password security against a dictionary attack and a brute force attack is suggested and used for security evaluation of these passwords. The method is based on a mathematical model and a simulation of dictionary attack and a brute force attack. In the paper trends of password selecting are identified and expected progress is outlined. Simultaneously truly used passwords are investigated by statistic methods.