[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572185-105":53,"doc-detail-572185-en":118},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":111,"head_meta":113,"extra_data":115,"updated_unix":117},105,"en","an-administrators-guide-to-internet-password-research-overview","An Administrator's Guide to Internet Password Research - Overview","","Password research offers extensive results, yet practical guidance for administrators securing web-facing services and setting password policies remains limited. This work evaluates implementation choices, policy and administration using literature survey and first-principles reasoning, identifying what succeeds, what fails, and what is still unknown. Results show offline attacks, strong-demand user effort, and expiration/strength thresholds behave differently than commonly assumed, and that excessive strength beyond online resistance can be wasted, especially with plaintext or reversible encryption storage.",{"@graph":63,"@context":110},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/an-administrators-guide-to-internet-password-research-overview/572185/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/an-administrators-guide-to-internet-password-research-overview/572185.png","ImageObject",442,249,{"name":88,"@type":89},"Alex Sinclair","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":73},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104],{"name":105,"@type":106,"acceptedAnswer":107},"Why is increased guessing resistance sometimes wasted for certain password storage methods?","Question",{"text":108,"@type":109},"At sites that store passwords in plaintext or reversibly encrypted form, the paper finds no attack scenario where additional effort beyond the online threshold protects the account against an intelligent adversary.","Answer","https://schema.org",{"og:url":78,"og:type":112,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":114,"canonical":78},"index,follow",{"doc_id":116,"site_id":56},572185,1792481817,{"code":4,"msg":5,"data":119},{"doc_id":116,"user_id":120,"nickname":88,"user_avatar":121,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":122,"file_id":123,"file_url":124,"file_type":125,"file_size":126,"view_count":73,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":40,"language":127,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":128,"faqs":129,"seo_title":130,"seo_description":61,"update_tm":131,"read_time":132},1099523882182,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","An Administrator's Guide to Internet Password Research􀀃  \nDinei Florncio and Cormac Herley Microsoft Research, Redmond, USA  \nPaul C. van Oorschot Carleton University, Ottawa, Canada  \nAbstract. The research literature on passwords is rich but little of it directly aids those charged with securing web-facing services or setting policies. With a view to improving this situation we examine questions of implementation choices, policy and administration using a combination of literature survey and first-principles reasoning to identify what works, what does not work, and what remains unknown. Some of our results are surprising. We find that offline attacks, the justification for great demands of user effort, occur in much more limited circumstances than is generally believed (and in only a minority of recently-reported breaches) . We find that an enormous gap exists between the effort needed to withstand online and offline attacks, with probable safety occurring when a password can survive 106 and 1014 guesses respectively. In this gap, eight orders of magnitude wide, there is little return on user effort: exceeding the online threshold but falling short of the offline one represents wasted effort. We find that guessing resistance above the online threshold is also wasted at sites that store passwords in plaintext or reversibly encrypted: there is no attack scenario where the extra effort protects the account.  \n1 Introduction  \nDespite the ubiquity of password-protected web sites, research guidance on the subject of running them is slight. Much of the password literature has become specialized, fragmented, or theoretical, and in places confusing and contradictory. Those who administer and set policies can hardly be blamed for being unenthusiastic about publications which document constantly improving attacks on password sites but are largely silent on the question of how they can be defended. Disappointingly little of the accumulating volume of password research directly addresses key everyday issues—what to do to protect web-  \n􀀃 Proceedings of USENIX LISA'14, Nov. 9-14, 2014, Seattle, WA.  \nservices, given the realities of finite-resources, imperfect understanding of the threats, and considerable pushback from users.  \nDo password composition policies work? Does forced password expiration improve security? Do lockouts help protect a service? What do password meters accomplish? The most comprehensive document on these and other questions dates to 1985 [13] . The problem is not that no recent guidance is available; OWASP offers several documents [39, 45, 56]; blogs, trade magazines and industry analyst reports are full of tips, best practices and opinions. Discussions in online fora reliably generate passionate arguments, if little progress. However, much of the available guidance lacks supporting evidence.  \nWe seek to establish what is supported by clear evidence and solid justification. Using a combination of literature survey and ground-up, first-principles reasoning, we identify what is known to work, what is known not to work, and what remains unknown. The end goal is a more useful view of what is known about the implementation, effectiveness, and impacts of choices made in deploying password-related mechanisms for access to services over the web. The target audience is those interested in the intersection of research literature, and the operation, administration and setting of policies for password-protected web-sites.  \nOn the positive side, considerable progress in the last few years has followed from analysis of leaked plaintext datasets. This has provided new evidence challenging many long-held beliefs. Most current password practices reflect historical origins [18] . Some have evolved overtime; others should have, but have not. Environments of use, platforms, and user bases have changed immensely. We summarize the literature useful to answer practical questions on the efficacy of policies governing password composition, expiration","cbCaifW9FI1g81O2","https://ap.wps.com/l/cbCaifW9FI1g81O2","pdf",689705,"English","# Introduction\n## Implementation and policy gaps\n## Evidence-backed guidance\n# Classifying accounts into categories\n## Effort budgets and account importance","[{\"question\":\"Why is increased guessing resistance sometimes wasted for certain password storage methods?\",\"answer\":\"At sites that store passwords in plaintext or reversibly encrypted form, the paper finds no attack scenario where additional effort beyond the online threshold protects the account against an intelligent adversary.\"}]","An Administrator's Guide to Internet Password Research - Overview | PDF",1791925995,6]