[Paper Review] DALock: Distribution Aware Password Throttling

Jeremiah Blocki, Wuwei Zhang|arXiv (Cornell University)|May 18, 2020

User Authentication and Security Systems40 references4 citations

TL;DR

This paper proposes DALock, a distribution-aware password throttling mechanism that reduces user lockouts during legitimate login attempts while improving resistance to online password guessing attacks. By tracking the cumulative probability of guessed passwords (via a 'hit count' $Ψ_u$) rather than just consecutive failures, DALock achieves a superior security-usability trade-off—reducing attacker success to 0.05% and legitimate lockouts to 0.08%, compared to 1% and 4% under standard 10-strikes and 3-strikes policies, respectively.

ABSTRACT

Large-scale online password guessing attacks are wide-spread and continuously qualified as one of the top cyber-security risks. The common method for mitigating the risk of online cracking is to lock out the user after a fixed number ($K$) of consecutive incorrect login attempts. Selecting the value of $K$ induces a classic security-usability trade-off. When $K$ is too large a hacker can (quickly) break into a significant fraction of user accounts, but when $K$ is too low we will start to annoy honest users by locking them out after a few mistakes. Motivated by the observation that honest user mistakes typically look quite different than the password guesses of an online attacker, we introduce DALock a {\em distribution aware} password lockout mechanism to reduce user annoyance while minimizing user risk. As the name suggests, DALock is designed to be aware of the frequency and popularity of the password used for login attacks while standard throttling mechanisms (e.g., $K$-strikes) are oblivious to the password distribution. In particular, DALock maintains an extra "hit count" in addition to "strike count" for each user which is based on (estimates of) the cumulative probability of {\em all} login attempts for that particular account. We empirically evaluate DALock with an extensive battery of simulations using real world password datasets. In comparison with the traditional $K$-strikes mechanism we find that DALock offers a superior security/usability trade-off. For example, in one of our simulations we are able to reduce the success rate of an attacker to $0.05\%$ (compared to $1\%$ for the $10$-strikes mechanism) whilst simultaneously reducing the unwanted lockout rate for accounts that are not under attack to just $0.08\%$ (compared to $4\%$ for the $3$-strikes mechanism).

Motivation & Objective

• To address the longstanding security-usability trade-off in password authentication, where fixed-threshold lockout mechanisms (e.g., K-strikes) either risk account compromise or frustrate legitimate users.
• To reduce unintended lockouts of honest users who make common typo patterns, while maintaining strong defense against automated password guessing.
• To design a throttling mechanism that is sensitive to password popularity and frequency distributions, unlike traditional K-strikes which are distribution-agnostic.
• To empirically validate that distribution-aware throttling can significantly outperform standard K-strikes in both security and usability metrics.
• To evaluate the robustness of the mechanism under differential privacy and data subsampling for real-world deployment.

Proposed method

• Introduces a dual-metric system: a traditional 'strike count' $K_u$ for consecutive failures and a new 'hit count' $\Psi_u$ representing the cumulative probability mass of all incorrect guesses for user $u$.
• Uses empirical password frequency distributions (from real datasets) to estimate $\mathsf{P}(pw)$, the likelihood of each password being guessed.
• Locks an account when $\Psi_u$ exceeds a threshold $\Psi$, rather than after $K$ consecutive failures.
• Employs the FMPPF (First-Most-Popular-Passwords-First) algorithm to simulate attacker behavior by prioritizing guesses based on password popularity.
• Applies Count Sketch with differential privacy and data subsampling to enable scalable, private deployment on large-scale systems.
• Simulates user mistakes via recall errors (2.4%) and typo patterns (e.g., caplock, transpositions, replacements) using empirical typo distributions from prior work.

Experimental results

Research questions

• RQ1 Can a throttling mechanism that accounts for password popularity reduce false lockouts of honest users without increasing vulnerability to online attacks?
• RQ2 How does the performance of distribution-aware throttling compare to traditional K-strikes in terms of attacker success rate and legitimate lockout rate?
• RQ3 To what extent does differential privacy and data subsampling affect the security and usability of the proposed mechanism?
• RQ4 Can the FMPPF algorithm closely approximate the theoretical upper bound on attacker success under the $\Psi$-threshold policy?
• RQ5 Does the hit count $\Psi_u$ effectively distinguish between attacker behavior (guessing popular passwords) and honest user errors (guessing rare, typo-prone variants)?

Key findings

• Under a 10-strikes policy, the attacker's success rate is 1%, but with DALock using $\Psi = 2^{-10}$, it drops to just 0.05%.
• For the same scenario, the legitimate lockout rate drops from 4% (under 3-strikes) to 0.08% with DALock, significantly improving usability.
• The FMPPF algorithm achieves near-theoretical optimal performance, closely approaching the upper bound of $\Psi + \mathsf{P}(pw_1)$, indicating minimal loss in attacker efficiency.
• Differential privacy has minimal impact on DALock’s performance, especially with large datasets, preserving both security and usability.
• Subsampling the dataset to 1% of its size still allows DALock to maintain strong performance, demonstrating scalability and robustness.
• The mechanism effectively reduces lockouts for users making common typo patterns (e.g., capitalization errors, insertions) because such passwords are typically not among the most popular.