Towards a better estimation of password Entropy NiST suggestion fails to consider usage of different category of characters: Lower-case letters, digits upper-case letters, special symbols Orders also matter : "Password 123! " should have different entropy from ao3swPd! 2sIr State of art: Variable-order markov chains to model probability of different strings as passwords: "A Study of Probabilistic Password Models" by Ma, Yang, Luo, Li in EEE S&P 2014 Fundamental challenge: there are different attack strategies out there, which try passwords with different ordering 39Towards a Better Estimation of Password Entropy • NIST suggestion fails to consider usage of different category of characters: Lower-case letters, digits, upper-case letters, special symbols • Orders also matter: “Password123!” should have different entropy from “ao3swPd!2s1r” • State of art: Variable-order markov chains to model probability of different strings as passwords: “A Study of Probabilistic Password Models” by Ma, Yang, Luo, Li in IEEE S&P 2014. • Fundamental challenge: there are different attack strategies out there, which try passwords with different ordering • . Topic 3: User Authentication 392/3/2021