SlideShare a Scribd company logo
Testing of
Password Policy
Anton Dedov

ZeroNights 2013
Who Am I
• Software Developer and Security Engineer
@ Parallels Automation
• Open source developer
• Mail: adedov@gmail.com
• Twitter: @brutemorse
Motivation
• It is hard for application developers to choose
between existing password meters reasonably.
• Worse, some implement their own [or
customize existing] without understanding of
security and psychological implications.
• Need some framework/criteria that would
help reasonable choice.

3
NAÏVE SECURITY MODEL
Untargeted Online Attacks
User base

Common
passwords
100 K

• 1 guess per user / day
• 2 days to find first password
• 100 days to find 50 passwords

10 K

100 K
2.5 K

5K

• 1 guess per user / day
• 10 days to find first password
• 1.5yr to find 50 passwords
Targeted Online Attacks
•
•
•
•
•

10 failed attempts  1 hour block
240 attempts per user / day
7200 attempts per user / month
86400 attempts per user / year
More IP-s scale linearly
Offline Attacks
• Huge dictionaries
• Specialized hardware and clusters
• No time/complexity limitations except
– Enforced password quality
– Hash speed
– Salt uniqueness

7
TESTING PASSWORD METERS
Candidates
•
•
•
•
•

Plesk
jquery.complexify
zxcvbn
libpwquality
passwdqc
Method
•
•
•
•

Apply meters to password bases
Dictionary attacks with JtR
Rule-based attacks with JtR
Collect essential parameters
Apply Meters
• Requirement: meter should provide
unambiguous signal about if password is
accepted or not.
• Passwdqc tells straight “OK” or “Bad”.
• Others return score. Minimal accepted score
documented.

11
Password Bases
•
•
•
•
•

Real customers
RockYou all
CMIYC-2010 not cracked
Random passphrases
Random 10-char passwords

Red for attacks; blue for psychological acceptance.
12
Dictionaries
Dictionary
Tiny English
RockYou top
Common-passwords
English
Tiny English crossed / 8 chars

Size, words
817
1438
3546
54316
72100

13
Rules
Rule
JtR defaults
JtR jumbo
m3g9tr0n-2048512
m3g9tr0n-2048517

Factor
~ 40
~ 5500
= 3510
~ 860

14
Cracking Sessions
None
JtR default

Tiny

817 words
41K words

JtR jumbo

4M words

m3g9tr0n2048512

2.8M words

m3g9tr0n2048517

707K words
15
Cracking Sessions
• 25 attacks per password base per meter
• Min dictionary size 817
• Max dictionary size 396M

RockYou dictionary was not used against RockYou password base.
16
Parameters
• M – passwords approved by meter
• D – attack dictionary size
• C – # of guessed passwords during attack
• Attack effectiveness

• Attack economy

C
M
C
D
17
Online Attacks Effectiveness

For dictionaries < 100K
Max guess rate 0.007%

18
Max Attack Effectiveness
0.1400%
0.1200%
0.1000%
0.0800%
0.0600%
0.0400%
0.0200%
0.0000%

passwdqc
customer2
customer1
rockyou

plesk

zxcvbn

complexify

pwquality

0.0304%
0.0210%
0.0011%

0.0130%
0.0089%
0.0002%

0.0182%
0.0315%
0.0130%

0.0546%
0.0460%
0.0049%

0.0794%
0.0290%
0.0224%
19
Max Attack Economy
160.0000%
140.0000%
120.0000%
100.0000%
80.0000%
60.0000%
40.0000%
20.0000%
0.0000%
rockyou
pwquality
complexify
zxcvbn
plesk
passwdqc

62.1545%
19.8816%
64.1850%
0.1224%
0.1224%

customer1
0.2782%
0.1224%
0.2782%
0.1224%
0.1224%

customer2
0.1224%
0.1224%
0.1224%
0.1224%
0.1224%

20
Average Attack Economy
9.0000%
8.0000%
7.0000%
6.0000%
5.0000%
4.0000%
3.0000%
2.0000%
1.0000%
0.0000%
rockyou
pwquality
complexify
zxcvbn
plesk
passwdqc

3.2154%
1.0375%
3.4033%
0.0079%
0.0137%

customer1
0.0177%
0.0095%
0.0180%
0.0092%
0.0092%

customer2
0.0093%
0.0101%
0.0096%
0.0092%
0.0094%

21
Guesses Totals
Meter
plesk
passwdqc
zxcvbn
complexify
libpwquality

RockYou

Customer 1

Customer 2

0.08%
0.18%
0.54%
0.54%
1.16%

0.28%
0.23%
0.26%
1.06%
0.50%

0.28%
0.12%
0.06%
0.40%
0.45%
Guesses Totals
2.50%

2.00%

1.50%

rockyou-all
customer2

1.00%

customer1
0.50%

0.00%

passwdqc

plesk

zxcvbn

complexify pwquality
23
Psy. Acceptance: User Passwords

Meter
plesk
passwdqc
zxcvbn
complexify
libpwquality

RockYou

Customer 1

Customer 2

0.21%
1.60%
5.43%
2.03%
4.32%

3.45%
14.90%
16.29%
7.05%
11.88%

5.53%
40.62%
43.16%
27.18%
34.27%
Psy. Acceptance: User Passwords
70.00%
60.00%
50.00%
40.00%

customer2
customer1

30.00%

rockyou-all
20.00%

10.00%
0.00%

passwdqc

plesk

zxcvbn complexify pwquality

25
Psy. Acceptance: Hard Passwords
Meter

plesk
passwdqc
zxcvbn
complexify
libpwquality

CMYIC-2010 Pass-Phrases

24%
59%
42%
3%
10%

0%
99.98%
99.76%
99.94%
99.82%

Random
10 chars
42%
100%
99.99%
0%
81%
26
Psy. Acceptance: Hard Passwords
100.00%
90.00%
80.00%
70.00%
60.00%

CMIYC2010-uncracked

50.00%

phrases-rand39

40.00%

random10

30.00%
20.00%
10.00%
0.00%
passwdqc

plesk

zxcvbn complexify pwquality
27
The “editors” choice
Security
passwdqc
plesk
zxcvbn
jquery.complexify
libpwquality

Psychology
zxcvbn
passwdqc
libpwquality
jquery.complexify
plesk

28
Conclusions
•
•
•
•

Test your security tools for security
Avoid write your own security tools
All tested meters protect from online attacks
Also seem protect from offline attacks
(for slow hashes and unique salts)

• But most tend to deny more passwords than it
is necessary, including known to be hard ones
• Passwdqc and zxcvbn look best
Where to go?
• Bigger dictionaries and brute force
• Testing on real people to
– Learn evolution of “common passwords” lists
– Test psychological acceptance empirically

• More meters?

30
Special thanks

Alexander Peslyak
Solar Designer

31
Bonus: time to process RockYou…
(MBP 2011)
3:15

zxcvbn
pwquality
plesk
passwdqc
complexify

5:48

0:13

0:26

0:16

0:00

1:12

2:24

3:36
Hours

4:48

6:00

7:12

More Related Content

What's hot

Bug Reporting
Bug ReportingBug Reporting
Bug Reporting
yousufaziz
 
Regression and performance testing
Regression and performance testingRegression and performance testing
Regression and performance testing
Himanshu
 
Agile Software Development Model
Agile Software Development ModelAgile Software Development Model
Agile Software Development Model
Ritika Balagan
 
Classical Encryption Techniques in Network Security
Classical Encryption Techniques in Network SecurityClassical Encryption Techniques in Network Security
Classical Encryption Techniques in Network Security
babak danyal
 
Session10-PHP Misconfiguration
Session10-PHP MisconfigurationSession10-PHP Misconfiguration
Session10-PHP Misconfiguration
zakieh alizadeh
 
Message authentication and hash function
Message authentication and hash functionMessage authentication and hash function
Message authentication and hash function
omarShiekh1
 
Unit - 4.pptx
Unit - 4.pptxUnit - 4.pptx
Unit - 4.pptx
mounikanarra3
 
Two fish cipher
Two fish cipherTwo fish cipher
Two fish cipher
Waqar Memon
 
Monoalphabetic Substitution Cipher
Monoalphabetic Substitution  CipherMonoalphabetic Substitution  Cipher
Monoalphabetic Substitution Cipher
SHUBHA CHATURVEDI
 
Managment spectrum
Managment spectrumManagment spectrum
Software Engineering- Types of Testing
Software Engineering- Types of TestingSoftware Engineering- Types of Testing
Software Engineering- Types of Testing
Trinity Dwarka
 
Bug reporting and tracking
Bug reporting and trackingBug reporting and tracking
Bug reporting and tracking
Vadym Muliavka
 
Cryptography for Penetration Testers (PDF version)
Cryptography for Penetration Testers (PDF version)Cryptography for Penetration Testers (PDF version)
Cryptography for Penetration Testers (PDF version)
ceng
 
Sandboxing
SandboxingSandboxing
Sandboxing
NSConclave
 
Black Box Testing
Black Box TestingBlack Box Testing
Black Box Testing
Nivetha Padmanaban
 
Transport layer security
Transport layer securityTransport layer security
Transport layer security
Hrudya Balachandran
 
CNIT 141: 5. Stream Ciphers
CNIT 141: 5. Stream CiphersCNIT 141: 5. Stream Ciphers
CNIT 141: 5. Stream Ciphers
Sam Bowne
 
SDLC - Software Development Life Cycle
SDLC - Software Development Life CycleSDLC - Software Development Life Cycle
SDLC - Software Development Life Cycle
Suresh Koujalagi
 
+Software development methodologies
+Software development methodologies+Software development methodologies
+Software development methodologies
walid sassi
 
Software Development Life Cycle
Software Development Life CycleSoftware Development Life Cycle
Software Development Life Cycle
Slideshare
 

What's hot (20)

Bug Reporting
Bug ReportingBug Reporting
Bug Reporting
 
Regression and performance testing
Regression and performance testingRegression and performance testing
Regression and performance testing
 
Agile Software Development Model
Agile Software Development ModelAgile Software Development Model
Agile Software Development Model
 
Classical Encryption Techniques in Network Security
Classical Encryption Techniques in Network SecurityClassical Encryption Techniques in Network Security
Classical Encryption Techniques in Network Security
 
Session10-PHP Misconfiguration
Session10-PHP MisconfigurationSession10-PHP Misconfiguration
Session10-PHP Misconfiguration
 
Message authentication and hash function
Message authentication and hash functionMessage authentication and hash function
Message authentication and hash function
 
Unit - 4.pptx
Unit - 4.pptxUnit - 4.pptx
Unit - 4.pptx
 
Two fish cipher
Two fish cipherTwo fish cipher
Two fish cipher
 
Monoalphabetic Substitution Cipher
Monoalphabetic Substitution  CipherMonoalphabetic Substitution  Cipher
Monoalphabetic Substitution Cipher
 
Managment spectrum
Managment spectrumManagment spectrum
Managment spectrum
 
Software Engineering- Types of Testing
Software Engineering- Types of TestingSoftware Engineering- Types of Testing
Software Engineering- Types of Testing
 
Bug reporting and tracking
Bug reporting and trackingBug reporting and tracking
Bug reporting and tracking
 
Cryptography for Penetration Testers (PDF version)
Cryptography for Penetration Testers (PDF version)Cryptography for Penetration Testers (PDF version)
Cryptography for Penetration Testers (PDF version)
 
Sandboxing
SandboxingSandboxing
Sandboxing
 
Black Box Testing
Black Box TestingBlack Box Testing
Black Box Testing
 
Transport layer security
Transport layer securityTransport layer security
Transport layer security
 
CNIT 141: 5. Stream Ciphers
CNIT 141: 5. Stream CiphersCNIT 141: 5. Stream Ciphers
CNIT 141: 5. Stream Ciphers
 
SDLC - Software Development Life Cycle
SDLC - Software Development Life CycleSDLC - Software Development Life Cycle
SDLC - Software Development Life Cycle
 
+Software development methodologies
+Software development methodologies+Software development methodologies
+Software development methodologies
 
Software Development Life Cycle
Software Development Life CycleSoftware Development Life Cycle
Software Development Life Cycle
 

Similar to ZeroNights2013 testing of password policy

Password Cracking
Password CrackingPassword Cracking
Password Cracking
Sagar Verma
 
Techniques for password hashing and cracking
Techniques for password hashing and crackingTechniques for password hashing and cracking
Techniques for password hashing and cracking
Nipun Joshi
 
TeelTech - Advancing Mobile Device Forensics (online version)
TeelTech - Advancing Mobile Device Forensics (online version)TeelTech - Advancing Mobile Device Forensics (online version)
TeelTech - Advancing Mobile Device Forensics (online version)
Mike Felch
 
Stress Test as a Culture
Stress Test as a CultureStress Test as a Culture
Stress Test as a Culture
João Moura
 
Apex triggers i
Apex triggers iApex triggers i
Apex triggers i
Obidjon Komiljonov
 
Geek Sync I CSI for SQL: Learn to be a SQL Sleuth
Geek Sync I CSI for SQL: Learn to be a SQL SleuthGeek Sync I CSI for SQL: Learn to be a SQL Sleuth
Geek Sync I CSI for SQL: Learn to be a SQL Sleuth
IDERA Software
 
Oracle database threats - LAOUC Webinar
Oracle database threats - LAOUC WebinarOracle database threats - LAOUC Webinar
Oracle database threats - LAOUC Webinar
Osama Mustafa
 
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
Ted Wentzel
 
Everything You Need to Know About Sharding
Everything You Need to Know About ShardingEverything You Need to Know About Sharding
Everything You Need to Know About Sharding
MongoDB
 
Login cat tekmonks - v3
Login cat   tekmonks - v3Login cat   tekmonks - v3
Login cat tekmonks - v3
TEKMONKS
 
Add Redis to Postgres to Make Your Microservices Go Boom!
Add Redis to Postgres to Make Your Microservices Go Boom!Add Redis to Postgres to Make Your Microservices Go Boom!
Add Redis to Postgres to Make Your Microservices Go Boom!
Dave Nielsen
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
vishalgohel12195
 
Docker/DevOps Meetup: Metrics-Driven Continuous Performance and Scalabilty
Docker/DevOps Meetup: Metrics-Driven Continuous Performance and ScalabiltyDocker/DevOps Meetup: Metrics-Driven Continuous Performance and Scalabilty
Docker/DevOps Meetup: Metrics-Driven Continuous Performance and Scalabilty
Andreas Grabner
 
ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...
ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...
ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...
Robert Conti Jr.
 
Journey of Migrating Millions of Queries on The Cloud
Journey of Migrating Millions of Queries on The CloudJourney of Migrating Millions of Queries on The Cloud
Journey of Migrating Millions of Queries on The Cloud
takezoe
 
Why everyone speaks about DR but only few use it?
Why everyone speaks about DR but only few use it?Why everyone speaks about DR but only few use it?
Why everyone speaks about DR but only few use it?
Francisco Alvarez
 
Securing Solr Search Data in the Cloud
Securing Solr Search Data in the CloudSecuring Solr Search Data in the Cloud
Securing Solr Search Data in the Cloud
Sameer Maggon
 
Securing Search Data in the Cloud
Securing Search Data in the CloudSecuring Search Data in the Cloud
Securing Search Data in the Cloud
SearchStax
 
Crafting tailored wordlists with Wordsmith
Crafting tailored wordlists with WordsmithCrafting tailored wordlists with Wordsmith
Crafting tailored wordlists with Wordsmith
Sanjiv Kawa
 
The Amino Analytical Framework - Leveraging Accumulo to the Fullest
The Amino Analytical Framework - Leveraging Accumulo to the Fullest The Amino Analytical Framework - Leveraging Accumulo to the Fullest
The Amino Analytical Framework - Leveraging Accumulo to the Fullest
Donald Miner
 

Similar to ZeroNights2013 testing of password policy (20)

Password Cracking
Password CrackingPassword Cracking
Password Cracking
 
Techniques for password hashing and cracking
Techniques for password hashing and crackingTechniques for password hashing and cracking
Techniques for password hashing and cracking
 
TeelTech - Advancing Mobile Device Forensics (online version)
TeelTech - Advancing Mobile Device Forensics (online version)TeelTech - Advancing Mobile Device Forensics (online version)
TeelTech - Advancing Mobile Device Forensics (online version)
 
Stress Test as a Culture
Stress Test as a CultureStress Test as a Culture
Stress Test as a Culture
 
Apex triggers i
Apex triggers iApex triggers i
Apex triggers i
 
Geek Sync I CSI for SQL: Learn to be a SQL Sleuth
Geek Sync I CSI for SQL: Learn to be a SQL SleuthGeek Sync I CSI for SQL: Learn to be a SQL Sleuth
Geek Sync I CSI for SQL: Learn to be a SQL Sleuth
 
Oracle database threats - LAOUC Webinar
Oracle database threats - LAOUC WebinarOracle database threats - LAOUC Webinar
Oracle database threats - LAOUC Webinar
 
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
 
Everything You Need to Know About Sharding
Everything You Need to Know About ShardingEverything You Need to Know About Sharding
Everything You Need to Know About Sharding
 
Login cat tekmonks - v3
Login cat   tekmonks - v3Login cat   tekmonks - v3
Login cat tekmonks - v3
 
Add Redis to Postgres to Make Your Microservices Go Boom!
Add Redis to Postgres to Make Your Microservices Go Boom!Add Redis to Postgres to Make Your Microservices Go Boom!
Add Redis to Postgres to Make Your Microservices Go Boom!
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
 
Docker/DevOps Meetup: Metrics-Driven Continuous Performance and Scalabilty
Docker/DevOps Meetup: Metrics-Driven Continuous Performance and ScalabiltyDocker/DevOps Meetup: Metrics-Driven Continuous Performance and Scalabilty
Docker/DevOps Meetup: Metrics-Driven Continuous Performance and Scalabilty
 
ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...
ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...
ISS Capstone - Martinez Technology Consulting and Cedar Hills Church Security...
 
Journey of Migrating Millions of Queries on The Cloud
Journey of Migrating Millions of Queries on The CloudJourney of Migrating Millions of Queries on The Cloud
Journey of Migrating Millions of Queries on The Cloud
 
Why everyone speaks about DR but only few use it?
Why everyone speaks about DR but only few use it?Why everyone speaks about DR but only few use it?
Why everyone speaks about DR but only few use it?
 
Securing Solr Search Data in the Cloud
Securing Solr Search Data in the CloudSecuring Solr Search Data in the Cloud
Securing Solr Search Data in the Cloud
 
Securing Search Data in the Cloud
Securing Search Data in the CloudSecuring Search Data in the Cloud
Securing Search Data in the Cloud
 
Crafting tailored wordlists with Wordsmith
Crafting tailored wordlists with WordsmithCrafting tailored wordlists with Wordsmith
Crafting tailored wordlists with Wordsmith
 
The Amino Analytical Framework - Leveraging Accumulo to the Fullest
The Amino Analytical Framework - Leveraging Accumulo to the Fullest The Amino Analytical Framework - Leveraging Accumulo to the Fullest
The Amino Analytical Framework - Leveraging Accumulo to the Fullest
 

Recently uploaded

Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
tolgahangng
 
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Tatiana Kojar
 
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
Data Hops
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Wask
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
panagenda
 
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptxNordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptx
MichaelKnudsen27
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
Javier Junquera
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Alex Pruden
 
Azure API Management to expose backend services securely
Azure API Management to expose backend services securelyAzure API Management to expose backend services securely
Azure API Management to expose backend services securely
Dinusha Kumarasiri
 
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy SurveyTrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc
 
WeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation TechniquesWeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation Techniques
Postman
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
akankshawande
 
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyFreshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
ScyllaDB
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Pixlogix Infotech
 
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
Edge AI and Vision Alliance
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
LucaBarbaro3
 
Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...
Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...
Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...
Jeffrey Haguewood
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
ssuserfac0301
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
panagenda
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
Jakub Marek
 

Recently uploaded (20)

Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
 
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
 
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
 
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptxNordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptx
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
 
Azure API Management to expose backend services securely
Azure API Management to expose backend services securelyAzure API Management to expose backend services securely
Azure API Management to expose backend services securely
 
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy SurveyTrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy Survey
 
WeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation TechniquesWeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation Techniques
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
 
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyFreshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
 
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
 
Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...
Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...
Salesforce Integration for Bonterra Impact Management (fka Social Solutions A...
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
 

ZeroNights2013 testing of password policy

Editor's Notes

  1. Naïve model
  2. 0.007 2276 0.64185 rockyou-all zxcvbn common-passwords-none
  3. 0.1224% : 1 to 1000
  4. 0.01% : 1 to 10000.001% : 1 to 10000
  5. 1.72% of CMYIC was cracked
  6. 20K/s vs. 2000/s