A Password Strength Measure.
Eugene Panferov · arXiv (Cornell University) · 2015
We notice that the security discourse is missing the most fundamental notion of the -- it was never properly defined. We propose a canonical definition of the strength, based on the assessment of the efficiency of a set of possible guessing attack. Unlike naive password strength assessments our metric takes into account the attacker's strategy, and we demonstrate the necessity of that feature. This paper does NOT advise you to include at least three capital letters, seven underscores, and a number thirteen in your password.