ZTE Communications ›› 2016, Vol. 14 ›› Issue (S0): 32-36.doi: 10.3969/j.issn.1673-5188.2016.S0.006

• Special Topic • Previous Articles     Next Articles

Password Pattern and Vulnerability Analysis for Web and Mobile Applications

LI Shancang, Imed Romdhani, William Buchanan   

  1. School of Computing,Edinburgh Napier University,Edinburgh EH10 5DT,Scotland,UK
  • Received:2016-05-21 Online:2016-06-01 Published:2019-11-29
  • About author:LI Shancang (s.li@napier.ac.uk), PhD, is a lecturer in Network Forensics in School of Computing at Edinburgh Napier University, UK. Over the last few years, he has been working on a few research projects funded by EU, EPSRC, Academic Expertise for Business (A4B), Technology Strategy Board (TSB), and industry. Based on these research projects, dozens of papers have been published. His current research interests include network forensics, security, wireless sensor networks, the Internet of Things (IoT), and lightweight cryptography over IoT.
    Imed Romdhani (i.romdhani@napier.ac.uk) is an associate professor in computer networking at Edinburgh Napier University, UK. He received his PhD from the University of Technology of Compiegne (UTC), France in May 2005, and an engineering and a master degree in networking obtained respectively in 1998 and 2001 from the National School of Computing (ENSI, Tunisia) and Louis Pasteur University of Strasbourg (ULP, France). He worked extensively with Motorola Research Labs in Paris and authored 4 patents in the field of IPv6, multicast mobility and IoT.
    William Buchanan (w.buchanan@napier.ac.uk) is a professor in the School of Computing at Edinburgh Napier University, UK, and a fellow of the BCS and the IET. He currently leads the Centre for Distributed Computing, Networks, and Security and The Cyber Academy, and works in the areas of security, cloud security, webbased infrastructures, e-crime, cryptography, triage, intrusion detection systems, digital forensics, mobile computing, agent-based systems, and security risk.

Abstract: Text-based passwords are heavily used to defense for many web and mobile applications. In this paper, we investigated the patterns and vulnerabilities for both web and mobile applications based on conditions of the Shannon entropy, Guessing entropy and Minimum entropy. We show how to substantially improve upon the strength of passwords based on the analysis of text-password entropies. By analyzing the passwords datasets of Rockyou and 163.com, we believe strong password can be designed based on good usability, deployability, rememberbility, and security entropies.

Key words: password strength, security entropies, password vulnerabilities