[Paper Review] Empirical Analysis of Password Reuse and Modification across Online Service

Chun Wang, Steve T. K. Jan+2 more|arXiv (Cornell University)|Jun 6, 2017

User Authentication and Security Systems21 references3 citations

TL;DR

This large-scale study analyzes 28.8 million users across 107 online services and finds that 38% reuse identical passwords and 21% modify existing passwords using highly predictable patterns. Using a training-based guessing algorithm, the authors show that 30% of modified passwords and all reused passwords can be cracked in 10 attempts, highlighting severe security risks from password reuse and predictable modification.

ABSTRACT

Leaked passwords from data breaches can pose a serious threat to users if the password is reused elsewhere. With more online services getting breached today, there is still a lack of large-scale quantitative understanding of the risks of password reuse across services. In this paper, we analyze a large collection of 28.8 million users and their 61.5 million passwords across 107 services. We find that 38% of the users have reused exactly the same password across different sites, while 20% have modified an existing password to create new ones. In addition, we find that the password modification patterns are highly consistent across different user demographics, indicating a high predictability. To quantify the risk, we build a new training-based guessing algorithm, and show that more than 16 million password pairs can be cracked within just 10 attempts (30% of the modified passwords and all the reused passwords).

Motivation & Objective

• To understand the prevalence and patterns of password reuse and modification across diverse online services at scale.
• To quantify the security risks introduced by password reuse and predictable modification patterns in real-world data breaches.
• To develop and evaluate a training-based password guessing algorithm that leverages consistent transformation patterns to predict modified passwords efficiently.
• To assess the feasibility of online password guessing attacks using minimal training data, given the low variance in user modification behavior.

Proposed method

• Collected and analyzed 61.5 million passwords from 28.8 million users across 107 online services, including major platforms like Gmail, Yahoo, and LinkedIn.
• Identified and categorized 8 high-level transformation rules (e.g., adding digits, capitalization) to model password modification patterns.
• Developed a Bayesian-based password guessing algorithm that prioritizes likely transformation rules based on training data, using rotational guessing to improve efficiency.
• Evaluated the algorithm’s performance on 7.2 million password pairs labeled as modifications, testing both full and minimal training data (down to 0.1%).
• Measured success rates within 10, 100, and 5000 attempts, comparing the proposed method to standard tools like John the Ripper (JtR).
• Tested the algorithm’s ability to recover salted password hashes from uncracked datasets, demonstrating effectiveness beyond plaintext guessing.

Experimental results

Research questions

• RQ1 What is the prevalence of password reuse and modification across a large-scale, diverse set of online services?
• RQ2 How consistent are password modification patterns across different user demographics (e.g., profession, country)?
• RQ3 To what extent can attackers predict modified passwords using minimal training data?
• RQ4 How effective is a training-based guessing algorithm in cracking modified passwords within a limited number of online attempts?
• RQ5 What is the combined impact of password reuse and predictable modification on the overall risk of account compromise?

Key findings

• 38% of users reused the exact same password across different services, with email services showing a particularly high reuse rate of 60.4%.
• 21% of users modified an existing password to create a new one, and these modification patterns were highly consistent across different user demographics.
• The proposed training-based guessing algorithm cracked 30% of modified passwords within 10 attempts and 46.5% within 100 attempts, significantly outperforming baseline tools.
• Even with only 0.1% of the data used for training, the algorithm achieved performance nearly identical to models trained on 50% of the data, confirming low variance in user behavior.
• More than 16 million password pairs (including 12.8 million reused and 3.8 million modified) could be cracked within 10 attempts, indicating massive online attack surface.
• The algorithm successfully recovered 15.1% (939,400) of previously uncracked password hashes within 5,000 attempts, demonstrating strong real-world applicability.