Design and Evaluation of a Password Diversifier Tool

Passwords can be well regarded as an integral aspect of our lives. However, reuse of passwords is prominent, making various accounts vulnerable to attacks. Within reuse, password structural reuse is a highly prevalent issue. Password structure is an ordered sequence that captures password composition using four character classes: Lowercase (L), Uppercase (U), Number (N), and Special Symbols (S). In case of targeted password guessing attack on a user, the risk of password disclosure increases manifold when the user reuses the password structure. To discourage reuse and enhance awareness of risk due to similarity in password structures, we test whether feedback to users on structural reuse risk would result in creation of diversified passwords. We develop an initial version of a tool named Password Diversifier and analyze password behavior in an experimental setup where users could enter various passwords or their structures and make changes to these based on recommendations. The tool analyses password diversity through similarity metrics, by comparing user’s password structures against each other as well as against some predefined heuristics. The tool also nudges the user to improve their password structures through in-built recommendations towards safer structures. We find from an experimental study with 53 users that users are able to create diversified passwords based on password risk related information given to them.