The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Analysis

This paper presents the first large-scale study of the success of password expiration in meeting its intended purpose, namely revoking access to an account by an attacker who has captured the account's password. Using a dataset of over 7700 accounts, the authors assess the extent to which passwords that users choose to replace expired ones pose an obstacle to the attacker's continued access. They develop a framework by which an attacker can search for a user's new password from an old one, and design an efficient algorithm to build an approximately optimal search strategy. They then use this strategy to measure the difficulty of breaking newly chosen passwords from old ones. They believe their study calls into question the merit of continuing the practice of password expiration.