Rainhard Findling's blog

10 million passwords: quick analysis underlines users' need for usability in security

rainhard.findling — Thu, 12 Feb 2015 12:33:17 +0000

A few days ago Mark Burnett fortunately released 10 million passwords captured for research to the public. Captured password lists are rarely that long - hence, this is a good opportunity to take a look at users' password usage, and test if our findings are in line with common sense and previous research on password usage. At first we need to convert the file to UTF-8 (you can download the converted file here). We then do a quick analysis of the data using a small Bash and R script. Specifically, we look at password lengths and the most used passwords.

When looking at the distribution of password length, we see that passwords of length 6 and 8 are used most. Length 3 and smaller seems to be used rarely, while above length 8 usage declines drastically.

The most frequently passwords could easily be guessed or derived by dictionary attacks - or are related to patterns users type on their keyboards (e.g. keys aligned horizontally or vertically on the keyboard that get pressed serially, like 1qaz2wsx). To underline that his is not only true for the 10 most frequently used passwords we show excerpts up to the #3000 to #3010 most used passwords here. And - as expected - the overall most frequently used passwords are combinations of 123456... (different lengths and orders).

(click to enlarge)

When looking at most frequently used passwords for specific lengths we see: the more the longer passwords get, the more users seem to try to related passwords to patterns on the keyboard layout (such as the vertically aligned 1qaz2wsx).

(click to enlarge)

While average users might already be aware that passwords like 123456 drastically decrease security and therefore are considered insecure, this might not be the case for passwords related to other keyboard layout patterns. Such patterns are even visible in passwords connected to possibly important accounts. Try some of the following grep filters on the password file to see examples:

grep $'root.*\t' 10-million-combos-utf8.txt
grep $'admin.*\t' 10-million-combos-utf8.txt
grep $'default.*\t' 10-million-combos-utf8.txt
grep $'config.*\t' 10-million-combos-utf8.txt
grep $'sql.*\t' 10-million-combos-utf8.txt
grep $'apache.*\t' 10-million-combos-utf8.txt
grep $'server.*\t' 10-million-combos-utf8.txt
grep $'wordpress.*\t' 10-million-combos-utf8.txt
grep $'bank.*\t' 10-million-combos-utf8.txt
grep $'research.*\t' 10-million-combos-utf8.txt
grep $'\.com\t' 10-million-combos-utf8.txt
grep $'\.at\t' 10-million-combos-utf8.txt
grep $'\.edu\t' 10-million-combos-utf8.txt

But most notably, these findings underline how users struggle to remember their secrets - hence use "tricks" to make remembering them easier, while also lowering the associated security.

How to get your thesis topic started

rainhard.findling — Tue, 17 Dec 2013 13:56:50 +0000

Students often struggle to get their thesis topic started properly, because they simply don't know how to start at all. In the end students may find that they have missed and left out major areas which would be in their topic's focus - which makes their thesis incomplete then. Correcting these issues regularly leaves students with a very huge amount of extra work. To address this issues this small guide has been created, which gives a short overview of how to get your thesis started, and - as a part of the task - how to effectively read papers.

Learn how to effectively skim through/read papers
Get an thorough overview of research done in your topic. You need to develop a "feeling" of what is already out there, and it's important to ensure to *not* miss any important sub-areas inside your research area.
When reading papers, keep a well structured reference list from the start (e.g. JabRef) of all literature you find interesting.
When having an overview and feeling of what is already there: discuss with your supervisor a) what is there and b) what to do next given this knowledge.
Ensure you have finished all that before doing the major implementation of your thesis and writing the thesis itself.

You need to search for publications (see scientific search engines below). Therefore, think of phrases that represent what you search for and will be contained in publication titles of the research area. For the start, they can be very easy phrases, like for face detection on mobile devices: "mobile face detection survey" or "mobile face detection review".
For first searchings, combine your phrases with the words "survey", "review" etc. as above. This way you will find publications that themselves sum up research in a particular research are up to the publication time. Such survey papers do this by listing/citing most important previous publications themselves (like with textbooks - for books you can use search terms containing e.g. "introduction" or "book"). Through these publications you will get a feeling for how researchers *call* their approaches - which will be very useful for future literature search.
Starting with the last point: for every publication you read and find interesting: keep a complete reference of the publication in your reference program (e.g. JabRef). Complete means including the abstract and publication file (if possible). Also write a very short "review" of the paper yourself to later immediately remember what the paper was about (e.g. "gives an overview of X with comparing approaches X1, X2 and X3" or "tries to solve problem X by using method Y. find out that [...]"). E.g. bibtex provides a "review" tag for this matter.
When read about something interesting in a publication that itself is cited there: jump to the reference list and grab the reference for further reading.
When you find a paper X interesting, check if there exist newer papers that cite paper X. Those papers might be interesting to you as the might have done further progress in research, based on paper X.

Use scientific search engines ("online libraries" for our sciences). Some libraries related to our sciences are listed below. Inside our university network you can download complete publications for most of those libraries (which is not possible outside the network - there you would have to pay for the access. Details on: http://www.fh-ooe.at/campus-hagenberg/campus/bibliothek/digitale-bibliot...).

scholar.google.com (very good as starting point)
citeseerx.ist.psu.edu
explore.ieee.org
dl.acm.org
sciencedirect.com
citeulike.org

Papers are almost always structured somehow similar to the following:

Title/Authors (most important: what is the paper in one sentence?)
Abstract (second most important: what is done in the paper?)
Introduction (what is the problem? - in detail)
Related work (other research the authors are aware of when writing their publication. Good for further reading)
Method / Approach (description and details how they address the problem)
Implementation + Evaluation (practically proving and measuring the method to see "how good it is")
Conclusion (third most important: what was done in the paper?)
References (corresponds to related work)

From the title decide if the paper seems related to your topic. If yes or if you are not sure about it: read the paper's abstract. Abstracts are short, therefore fast to read - and as for papers, abstracts are often structured similarly:

What is the problem the authors address?
Why is this problem important / why is it still unsolved / what are it's difficulties?
Which approach do the authors propose? What do the authors therefore contribute to the research field?
What is the method the authors use in their approach?
How did they evaluate their problem?
What are the evaluation results? What can be concluded from these results for the research field?

From a first skim of the abstract you should be able to decide if the paper targets your research area. If yes: read the abstract at least so carefully that you can roughly answer yourself the questions above. If you find the paper still to be interesting for you, skim through the conclusion. The conclusion essentially tells you what the authors did in the paper (so it's similar to the abstract, also in length - but written from the point of view that you *already read* the paper). When reading the conclusion you can re-check that your assumptions about the paper's content were correct. If the paper seems still interesting you can now start "reading" the paper. Skim through the introduction - if you already know about the problem the authors address in the publication in detail. If you do not yet, read it carefully to understand the details of the problem the authors want to address. Read through the related work to get an overview of the literature the authors were aware of when writing their publication. This is a good point to look out for other papers that are directly correlated to this paper for further reading. The sections from method to evaluation go into more detail on the approach the authors used to address the stated problem. Here, a "good paper" is written so that readers can fully reimplement and reevaluate the method - as it states all necessary details. Therefore, it is often sufficient if you dont' understand everything in full detail (except you want to write about this exact approach, reimplement it etc.). But read the method at least so carefully that you can answer somebody else the question: how did the authors address the problem/what is their method? What were findings for their approach within the evaluation?

After finishing reading the paper state very short in your own words what the paper is about in your reference as a review (as stated, bibtex provides a "review" tag for this). This review is mainly for you to immediately remember what the paper is about/how they did what the did - without needing to re-read the whole paper.

Now, after having finished a paper X you found it interesting: if you would like to read futher, related publications (besides reading the related work cited in the paper) you can search for papers that cite paper X themselves. Those papers might be interesting as they might have further progressed in research based on the findings of paper X. To do so search for your paper on scientific search engines and look out for tabs like "cited by" or "active bibliography".

First: there exist multiple types of papers.
Short paper: e.g. <=4 pages: a shorter version of a paper. Does not go in too much details, therefore often has less references or evaluation. Often the purpose is stating an idea.
Paper: e.g 7-10 pages: "normal" paper, basically as described above.
Article: longer and more comprehensive version of a paper. Describes the problem, related work and method in even more detail, does a extensive evaluation. Articles are often extended version of "normal" papers, so you might find a paper and an article describing the same thing - with the article being the more comprehensive publication.

Second: how to estimate the quality of a paper you are reading?
Be careful in case the paper seems completely unstructured or major parts are missing (e.g. there is basically no related work stated in the paper or the evaluation of the method is completely missing). It's often a hint of reduced quality if a paper contains many typos, formatting errors or if it has (as a non short paper) only a couple of references (not counting internet references). Usually normal papers have somewhere in the range of 10-30 references.

Dr. Bulling talks on Pervasive Eye-Based Human-Computer Interfaces

rainhard.findling — Thu, 12 Dec 2013 11:24:12 +0000

Dr. Anreas Bulling (Max Planck Institute for Informatics, Germany) will give a guest talk about "Pervasive Eye-Based Human-Computer Interfaces" on the 8. of January 2014 at the University of Applied Sciences Upper Austria, School of Informatics, Communications & Media, Hagenberg Campus. The event is free and open to the public, no registration required!

Date/Time:
08.01.2014, 10:30 - 11:30

Location:
University of Applied Sciences Upper Austria
School of Informatics,Communications and Media
Softwarepark 11, 4232 Hagenberg/Austria
http://www-en.fh-ooe.at/hagenberg-campus

Details:
http://www.fh-ooe.at/campus-hagenberg/aktuelles/fh-ooe-events-hagenberg/fh-ooe-events-hagenberg/article/guest-lecture-pervasive-eye-based-human-computer-interfaces-dr-andreas-bulling-saarland-univer/

Abstract: Recent years have seen considerable advances in mobile and stationary eye tracking equipment as well as automated eye movement analysis. However, previous work on computational methods and eye-based human-computer interfaces developed use of the eyes in traditional ("desktop") settings that involved single user, single device and WIMP-style interactions. The vast majority of previous work also followed the "gaze as a mouse replacement" paradigm, i.e. the use of gaze information for explicit interaction. This is despite the fact that the eyes are involved in nearly everything that we do and therefore hold a lot (more) valuable information for interactive and context-aware systems.

In his talk Dr. Bulling will first provide an introduction to the state-of-the-art in eye tracking and eye-based human-computer interaction. He will then motivate and describe a vision for the next generation of so-called pervasive eye-based user interfaces that continuously analyse and fully exploit the wealth of information contained in visual behaviour in all explicit and implicit interactions that users perform with computing systems throughout the day.
In the second part of his talk he will show key examples of the previous and ongoing work in this emerging area of research.

Biography: Dr. Andreas Bulling is head (W2) of the Perceptual User Interfaces Group at the Max Planck Institute for Informatics and the Cluster of Excellence on Multimodal Computing and Interaction at Saarland University. He received his MSc. (Dipl.-Inform.) in Computer Science from the Technical University of Karlsruhe (TH), Germany, in 2006, focusing on embedded systems, robotics and biomedical engineering. He holds a PhD in Information Technology and Electrical Engineering from the Swiss Federal Institute of Technology (ETH) Zurich, Switzerland. Dr. Bulling was previously a Feodor Lynen Research Fellow and a Marie Curie Research Fellow in the Computer Laboratory at the University of Cambridge, United Kingdom, a postdoctoral research associate in the School of Computing and Communications at Lancaster University, United Kingdom, as well as a Junior Research Fellow at Wolfson College, Cambridge. Dr. Bulling served as co-chair, TPC member and reviewer for major conferences and journals as well as TPC co-chair for AugmentedHuman 2013, vice program chair for PerCom 2015, and associate chair for CHI 2013 and CHI 2014.

Reference exporter: Jabref to RTF (Microsoft Word)

rainhard.findling — Tue, 13 Aug 2013 15:05:22 +0000

If you need to use references in MS-Word, but usually work with Jabref and want to keep your references stored in a single place, you can use the Jabref to RTF export functionality shipped with Jabref. We've created a demo for exporting Jabref references to (almost) fit the Harvard style required for the IJPCC (http://www.emeraldinsight.com/products/journals/journals.htm?id=ijpcc).

How to create own layout files for .rtf export:

Download the jabref.jar from http://jabref.sourceforge.net/download.php and extract the files in resource/layout/harvard (to only name one Jabref to .rtf-example)
Manipulate those files to your needs - they are basically self explanatory. A list of keywords is available at http://jabref.sourceforge.net/help/CustomExports.php, but unfortunately this list seems to be incomplete. You can further add new, not yet existing layout files (e.g. for manuals) - they get applied automatically if the type of publication in your .bib file matches.

How to include these files to Jabref to perform an export:

Jabref->Options->Manage custom exports->Add new. The main layout file is the .layout file within the extracted layout files - without any publication type, such as article. The file extension is the export file extension, so "rtf" if you want to copy them to a MS-Word document later.
Jabref->File->Export: chose your custom export here to finally perform the export.

You can download the demo exporter files here: http://db.tt/NWVd3K2v.

Rainhard Findling's blog

10 million passwords: quick analysis underlines users' need for usability in security

Distribution of password length

Overall most frequently used passwords

Most frequently used passwords per password length

How to get your thesis topic started

Major steps for getting your thesis topic started

How to get an overview of research done in your topic's area, or: how to search for papers

Where to search for papers

How to effectively read a paper

Write a very short review - in your own words

Further reading - starting at this publication

Two more things

Dr. Bulling talks on Pervasive Eye-Based Human-Computer Interfaces

Reference exporter: Jabref to RTF (Microsoft Word)