Password Security via Public Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in creating and maintaining secure passwords that meet security complexity thresholds while avoiding easy-to-guess patterns, leading to potential hacking risks due to the reuse of weak or similarly constructed passwords across multiple services.
Innovation Solution
A system that utilizes publicly available data, such as personal details and trending events, to generate sample passwords and compare them to user-generated passwords, recommending alternative passwords if common elements are found, thereby increasing password security and reducing the risk of hacking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users choose passwords that are easy to recall and use, then ease of operation is improved, but security is worsened because such passwords are easier to guess or crack
Solution Approach 1:
The system introduces an intermediary service that generates secure passwords based on user profile data and security criteria, mediating between the user's need for memorable passwords and the security requirement for strong passwords. The service acts as a trusted third party that creates passwords meeting both usability and security requirements.
Solution Approach 2:
The system enables self-service by allowing users to generate their own secure passwords through the service, which uses their personal data to create customized passwords. Users can independently manage their password security without requiring manual intervention from administrators or security experts.
2Reliability
If security policies require passwords to meet complexity thresholds (length, character variety, no repeated characters), then password security is improved, but ease of operation is worsened because creating and maintaining such passwords becomes more difficult
Solution Approach 1:
The system enables self-service by allowing users to generate their own secure passwords through the service, which uses their personal data to create customized passwords. Users can independently manage their password security without requiring manual intervention from administrators or security experts.
Solution Approach 2:
The system changes the parameters of password generation by using user profile data (names, birthdays, interests) as input parameters to generate passwords that automatically meet complexity requirements. This transforms the password creation process from manual compliance checking to automated parameter-based generation.
3Ease of operation
If users reuse weak or similarly constructed passwords across multiple services, then ease of operation is improved because they only need to remember one or few passwords, but security is worsened because a breach at one service compromises multiple services
Solution Approach 1:
The system segments the password generation process by creating unique passwords for each service based on the service name and user profile data. Instead of using a single password across multiple services, the system divides password creation into service-specific instances, ensuring that a breach at one service does not compromise others.
Solution Approach 2:
The system changes the parameters of password generation by using user profile data (names, birthdays, interests) as input parameters to generate passwords that automatically meet complexity requirements. This transforms the password creation process from manual compliance checking to automated parameter-based generation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are described herein that are capable of increasing security of a password-protected resource based on publicly available data. For instance, password generation models may be extracted from passwords (e.g., encrypted versions of the passwords) that are generated by users. A user password (e.g., encrypted version of the user password) may be received to be utilized to access a designated password-protected resource from a user of a computing device. Publicly available data regarding the user may be obtained. The password generation models may be applied using the publicly available data to generate sample passwords. The sample passwords may be compared to the user password to determine that the user password and each of one or more of the sample passwords include at least one common element. An alternative password may be recommended for use by the user in lieu of the user password.