Analyzing the usage of character groups and keyboard patterns in password creation. (20th January 2020)

• Record Type: Journal Article
• Authors: Kävrestad, Joakim; Zaxmy, Johan; Nohlberg, Marcus
• Is Part Of: Information and computer security. Volume 28:Number 3(2020)
• Page Start: 347
• Page End: 358
• Publication Date: 2020-01-20
• Subjects: Computer security -- Security -- Encryption -- Usage -- Password; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-11-2019-0132
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: Using passwords to keep account and data safe is very common in modern computing. The purpose of this paper is to look into methods for cracking passwords as a means of increasing security, a practice commonly used in penetration testing. Further, in the discipline of digital forensics, password cracking is often an essential part of a computer examination as data has to be decrypted to be analyzed. This paper seeks to look into how users that actively encrypt data construct their passwords to benefit the forensics community. Design/methodology/approach: The study began with an automated analysis of over one billion passwords in 22 different password databases that leaked to the internet. The study validated the result with an experiment were passwords created on a local website was analyzed during account creation. Further a survey was used to gather data that was used to identify differences in password behavior between user that actively encrypt their data and other users. Findings: The result of this study suggests that American lowercase letters and numbers are present in almost every password and that users seem to avoid using special characters if they can. Further, the study suggests that users that actively encrypt their data are more prone to use keyboard patterns as passwords than other users. Originality/value: This paper contributes to the existing body of knowledge around password behavior and suggests that password-guessing attacks should focus on American letters and numbers. Further, the paper suggests that forensics experts should consider testing patterns-based passwords when performing password-guessing attacks against encrypted data.