Frequency of compromised passwords used by students and staff of Asia Pacific College: an analysis using NIST SP 800-63B and pwned passwords. (February 2019)

• Record Type: Journal Article
• Authors: Roig, JV; de la Cuesta, J; Castillo, J; Cabardo, J; Casiño, E; Salalima, E; Sanchez, M
• Is Part Of: IOP conference series. Volume 482(2019)
• Publication Date: 2019-02
• Subjects: Materials science -- Periodicals; 620.1105
• DOI: 10.1088/1757-899X/482/1/012035
• Languages: English
• ISSNs: 1757-8981

Abstract

Abstract: The National Institute of Standards and Technology (NIST) released new guidelines in June of 2017 that recommended new standards for managing and accepting user passwords. Among the new guidelines is a requirement that verifiers should check if a user's supplied password is compromised – that is, already listed in previous breach corpuses. Using a corpus of 320 million breached passwords, the researchers conducted an experiment to gauge what percentage of the population of their home institution, Asia Pacific College, use compromised passwords. The study found that 16.72% overall – or 1 in 6 people – were using passwords that are part of the 320M breach corpus. This paper also provides a methodology that other institutions and companies can use to conduct the same analysis in order to gather data specific to their population that can guide the improvement of their password policies and related IT security services.