D. Kleeman

Followers

Following

Co-author

Public Views

Sherman S.M. Chow

The Chinese University of Hong Kong

Armando Marques-Guedes

UNL - New University of Lisbon

Md. Asraful Haque

Aligarh Muslim University

Paul Tobin

Dublin Institute of Technology

Lenandlar Singh

University of Guyana

Roshan Chitrakar

Nepal College of Information Technology

Dr. Shadab Alam

Jazan University

OLANREWAJU AYANNUGA

Yaba College of Technology, Lagos. Nigeria

Jai Maurya

Maharshi Dayanand University

Amir Herzberg

University of Connecticut

Interests

Uploads

Papers by D. Kleeman

Impact of restrictive composition policy on user password choices

Behaviour & Information Technology, 2011

... While it appears that restrictive password composi-tion rules improved password strength by e... more

Password Entropy and Password Quality

by Wanli Ma and D. Kleeman

2010 Fourth International Conference on Network and System Security, 2010

Passwords are the first line of defense for many computerized systems. The quality of these passw... more Passwords are the first line of defense for many computerized systems. The quality of these passwords decides the security strength of these systems. Many studies advocate using password entropy as an indicator for password quality where lower entropy suggests a weaker or less secure password. However, a closer examination of this literature shows that password entropy is very loosely defined. In this paper, we first discuss the calculation of password entropy and explain why it is an inadequate indicator of password quality. We then establish a password quality assessment scheme: password quality indicator (PQI). The PQI of a password is a pair ) , ( L D = λ , where D is the Levenshtein's editing distance of the password in relation to a dictionary of words and common mnemonics, and L is the effective password length. Finally, we propose to use PQI to prescribe the characteristics of good quality passwords.

Download

The Good and Not So Good of Enforcing Password Composition Rules

by Wanli Ma and D. Kleeman

Information Systems Security, 2007

... DS, McCauley-Bell, P., Malone, LC and DeMara, RF (2004) Evaluation of the Human Impact of Pas... more

Impact of restrictive composition policy on user password choices

by Wanli Ma and D. Kleeman

Behaviour & Information Technology, 2011

... While it appears that restrictive password composi-tion rules improved password strength by e... more

A Conceptual Framework for Assessing Password Quality

by Wanli Ma and D. Kleeman

Password authentication is the most widely used authentication mechanism, and it will still be wi... more Password authentication is the most widely used authentication mechanism, and it will still be with us for many years yet to come. It is effective, simple, and accurate, with no extra cost. The strength of password authentication relies on the strength of the passwords. Good (or strong) passwords are essential for high level security. End user education and computerized proactive password checking play vital roles in ensuring good passwords. However, both demand clear, simple, and concise rules on what a good password is. It is not hard to find guidelines and advices on good passwords; but it is not so easy to find a clear, simple, and concise rule to be used for end user education and computer programs for proactive password checking. In this paper, we develop a theoretic framework on measuring password qualitypassword quality indicator (PQI). A PQI of a password is a pair ) , ( L D = λ , where D is the Levenshtein's edit distance of the password to the base dictionary words, and L is the effective password length. Based on PQI, we further simplify the rule for a good password to at least 8 characters long, with at least 3 special characters plus other alphanumeric characters.

Download

Password Composition Policy: Does Enforcement Lead to Better Password Choices?

by Wanli Ma and D. Kleeman

The primary function of access controls is to restrict the use of information systems and other c... more The primary function of access controls is to restrict the use of information systems and other computer resources to authorised users only. Although more secure alternatives exist, password-based systems remain the predominant method of user authentication. Prior research shows that password security is often compromised by users who adopt inadequate password composition and management practices. One particularly underresearched area is whether formal password composition policies actually lead to more secure passwords and user security practices. Consequently, this study investigates empirically the efficacy of using password composition rules to improve password security. The results show that the enforcement of password composition rules does not significantly reduce the use of meaningful data. While the enforcement of rules does reduce password reuse, the overall incidence remains high. These passwords are also perceived by users as being more difficult to remember. Finally, the enforcement of password composition rules significantly increases the average Levenshtein's edit distance between the passwords and ordinary dictionary words indicating that enforcement does improve protection against dictionary-based attack.