{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,15]],"date-time":"2026-10-15T13:40:11Z","timestamp":1792071611067,"version":"4.4.0"},"publisher-location":"New York, NY, USA","reference-count":34,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,10,30]],"date-time":"2020-10-30T00:00:00Z","timestamp":1604016000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,10,30]]},"DOI":"10.1145\/3372297.3417882","type":"proceedings-article","created":{"date-parts":[[2020,11,2]],"date-time":"2020-11-02T18:27:04Z","timestamp":1604341624000},"page":"1407-1426","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":46,"title":["Practical Recommendations for Stronger, More Usable Passwords Combining Minimum-strength, Minimum-length, and Blocklist Requirements"],"prefix":"10.1145","author":[{"given":"Joshua","family":"Tan","sequence":"first","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lujo","family":"Bauer","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nicolas","family":"Christin","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lorrie Faith","family":"Cranor","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,11,2]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"andr0id. 2004. Word lists. http:\/\/www.outpost9.com\/files\/WordLists.html.  andr0id. 2004. Word lists. http:\/\/www.outpost9.com\/files\/WordLists.html."},{"key":"e_1_3_2_2_2_1","unstructured":"bbondy. 2015. bloom-filter-js. https:\/\/github.com\/bbondy\/bloom-filter-js.  bbondy. 2015. bloom-filter-js. https:\/\/github.com\/bbondy\/bloom-filter-js."},{"key":"e_1_3_2_2_3_1","unstructured":"Mark Burnett. 2015. Today I am releasing ten million passwords. https:\/\/xato.net\/today-i-am-releasing-ten-million-passwords-b6278bbe7495.  Mark Burnett. 2015. Today I am releasing ten million passwords. https:\/\/xato.net\/today-i-am-releasing-ten-million-passwords-b6278bbe7495."},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"crossref","unstructured":"Xavier De Carn\u00e9 De Carnavalet and Mohammad Mannan. 2014. From Very Weak to Very Strong: Analyzing Password-Strength Meters. In NDSS. 23--26.  Xavier De Carn\u00e9 De Carnavalet and Mohammad Mannan. 2014. From Very Weak to Very Strong: Analyzing Password-Strength Meters. In NDSS. 23--26.","DOI":"10.14722\/ndss.2014.23268"},{"key":"e_1_3_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813631"},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2501604.2501617"},{"key":"e_1_3_2_2_7_1","doi-asserted-by":"publisher","DOI":"10.5555\/2717491.2717494"},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.14722\/usec.2017.23043"},{"key":"e_1_3_2_2_9_1","unstructured":"Troy Hunt. 2018. Enhancing Pwned Passwords Privacy by Exclusively Supporting Anonymity. https:\/\/www.troyhunt.com\/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity.  Troy Hunt. 2018. Enhancing Pwned Passwords Privacy by Exclusively Supporting Anonymity. https:\/\/www.troyhunt.com\/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity."},{"key":"e_1_3_2_2_10_1","unstructured":"Troy Hunt. 2019. Pwned Passwords API. https:\/\/haveibeenpwned.com\/Passwords.  Troy Hunt. 2019. Pwned Passwords API. https:\/\/haveibeenpwned.com\/Passwords."},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.38"},{"key":"e_1_3_2_2_12_1","volume-title":"23rd USENIX Security Symposium (USENIX Security 14)","author":"Komanduri Saranga","year":"2014","unstructured":"Saranga Komanduri , Richard Shay , Lorrie Faith Cranor , Cormac Herley , and Stuart Schechter . 2014 . Telepathwords: Preventing Weak Passwords by Reading Userstextquoteright Minds . In 23rd USENIX Security Symposium (USENIX Security 14) . USENIX Association, San Diego, CA, 591--606. Saranga Komanduri, Richard Shay, Lorrie Faith Cranor, Cormac Herley, and Stuart Schechter. 2014. Telepathwords: Preventing Weak Passwords by Reading Userstextquoteright Minds. In 23rd USENIX Security Symposium (USENIX Security 14). USENIX Association, San Diego, CA, 591--606."},{"key":"e_1_3_2_2_13_1","volume-title":"Of Passwords and People: Measuring the Effect of Password-Composition Policies. In CHI '11: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. ACM, 2595--2604","author":"Komanduri Saranga","year":"2011","unstructured":"Saranga Komanduri , Richard Shay , Patrick Gage Kelley , Michelle L Mazurek , Lujo Bauer , Nicolas Christin , Lorrie Faith Cranor , and Serge Egelman . 2011 . Of Passwords and People: Measuring the Effect of Password-Composition Policies. In CHI '11: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. ACM, 2595--2604 . Saranga Komanduri, Richard Shay, Patrick Gage Kelley, Michelle L Mazurek, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Serge Egelman. 2011. Of Passwords and People: Measuring the Effect of Password-Composition Policies. In CHI '11: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. ACM, 2595--2604."},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516726"},{"key":"e_1_3_2_2_15_1","volume-title":"Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems","author":"Melicher William","unstructured":"William Melicher , Darya Kurilova , Sean M. Segreti , Pranshu Kalvani , Richard Shay , Blase Ur , Lujo Bauer , Nicolas Christin , Lorrie Faith Cranor , and Michelle L. Mazurek . 2016a. Usability and Security of Text Passwords on Mobile Devices . In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems ( San Jose, California, USA) (CHI '16). ACM, New York, NY, USA, 527--539. https:\/\/doi.org\/10.1145\/2858036.2858384 10.1145\/2858036.2858384 William Melicher, Darya Kurilova, Sean M. Segreti, Pranshu Kalvani, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L. Mazurek. 2016a. Usability and Security of Text Passwords on Mobile Devices. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (San Jose, California, USA) (CHI '16). ACM, New York, NY, USA, 527--539. https:\/\/doi.org\/10.1145\/2858036.2858384"},{"key":"e_1_3_2_2_16_1","volume-title":"Proceedings of the 25th USENIX Security Symposium.","author":"Melicher William","year":"2016","unstructured":"William Melicher , Blase Ur , Sean M Segreti , Saranga Komanduri , Lujo Bauer , Nicolas Christin , and Lorrie Faith Cranor . 2016 b. Fast, lean, and accurate: Modeling password guessability using neural networks . In Proceedings of the 25th USENIX Security Symposium. William Melicher, Blase Ur, Sean M Segreti, Saranga Komanduri, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2016b. Fast, lean, and accurate: Modeling password guessability using neural networks. In Proceedings of the 25th USENIX Security Symposium."},{"key":"e_1_3_2_2_17_1","unstructured":"Randall Munroe. 2011. Password strength. https:\/\/xkcd.com\/936\/.  Randall Munroe. 2011. Password strength. https:\/\/xkcd.com\/936\/."},{"key":"e_1_3_2_2_18_1","unstructured":"National Institute of Standards and Technology (NIST). 2004. SP 800--63 Ver. 1.0: Electronic Authentication Guideline. https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800--63\/ver-10\/archive\/2004-06--30.  National Institute of Standards and Technology (NIST). 2004. SP 800--63 Ver. 1.0: Electronic Authentication Guideline. https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800--63\/ver-10\/archive\/2004-06--30."},{"key":"e_1_3_2_2_19_1","volume-title":"SP 800--63B: Digital Identity Guidelines: Authentication and Lifecycle Management. https:\/\/doi.org\/10.6028\/NIST.SP.800--63--3. Updated","author":"National Institute of Standards and Technology (NIST). 2017.","year":"2017","unstructured":"National Institute of Standards and Technology (NIST). 2017. SP 800--63B: Digital Identity Guidelines: Authentication and Lifecycle Management. https:\/\/doi.org\/10.6028\/NIST.SP.800--63--3. Updated Dec 2017 . 10.6028\/NIST.SP.800--63--3 National Institute of Standards and Technology (NIST). 2017. SP 800--63B: Digital Identity Guidelines: Authentication and Lifecycle Management. https:\/\/doi.org\/10.6028\/NIST.SP.800--63--3. Updated Dec 2017."},{"key":"e_1_3_2_2_20_1","unstructured":"Openwall. 2003. Openwall file archive. http:\/\/download.openwall.net\/pub\/wordlists\/languages\/English\/4-extra\/lower.gz.  Openwall. 2003. Openwall file archive. http:\/\/download.openwall.net\/pub\/wordlists\/languages\/English\/4-extra\/lower.gz."},{"key":"e_1_3_2_2_21_1","unstructured":"Password Research Team at Carnegie Mellon University. 2019. Password Guessability Service. https:\/\/pgs.ece.cmu.edu.  Password Research Team at Carnegie Mellon University. 2019. Password Guessability Service. https:\/\/pgs.ece.cmu.edu."},{"key":"e_1_3_2_2_22_1","volume-title":"Hana Habib, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Serge Egelman, and Alain Forget.","author":"Pearman Sarah","year":"2017","unstructured":"Sarah Pearman , Jeremy Thomas , Pardis Emami Naeini , Hana Habib, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Serge Egelman, and Alain Forget. 2017 . Let's go in for a closer look: Observing passwords in their natural habitat. In CCS. Sarah Pearman, Jeremy Thomas, Pardis Emami Naeini, Hana Habib, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Serge Egelman, and Alain Forget. 2017. Let's go in for a closer look: Observing passwords in their natural habitat. In CCS."},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.3758\/BF03195438"},{"key":"e_1_3_2_2_24_1","volume-title":"SOUPS '17: Proceedings of the 13th Symposium on Usable Privacy and Security. USENIX.","author":"Segreti Sean M","year":"2017","unstructured":"Sean M Segreti , William Melicher , Saranga Komanduri , Darya Melicher , Richard Shay , Blase Ur , Lujo Bauer , Nicolas Christin , Lorrie Faith Cranor , and Michelle L Mazurek . 2017 . Diversify to survive: Making passwords stronger with adaptive policies . In SOUPS '17: Proceedings of the 13th Symposium on Usable Privacy and Security. USENIX. Sean M Segreti, William Melicher, Saranga Komanduri, Darya Melicher, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L Mazurek. 2017. Diversify to survive: Making passwords stronger with adaptive policies. In SOUPS '17: Proceedings of the 13th Symposium on Usable Privacy and Security. USENIX."},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702586"},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/2556288.2557377"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2891411"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3025453.3026050"},{"key":"e_1_3_2_2_29_1","volume-title":"Proceedings of the 21st USENIX Security Symposium. USENIX Association.","author":"Ur Blase","year":"2012","unstructured":"Blase Ur , Patrick Gage Kelley , Saranga Komanduri , Joel Lee , Michael Maass , Michelle L Mazurek , Timothy Passaro , Richard Shay , Timothy Vidas , Lujo Bauer , Nicolas Christin , and Lorrie Faith Cranor . 2012 . How does your password measure up? The effect of strength meters on password creation . In Proceedings of the 21st USENIX Security Symposium. USENIX Association. Blase Ur, Patrick Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass, Michelle L Mazurek, Timothy Passaro, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2012. How does your password measure up? The effect of strength meters on password creation. In Proceedings of the 21st USENIX Security Symposium. USENIX Association."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.5555\/2831143.2831173"},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2007.03.007"},{"key":"e_1_3_2_2_32_1","volume-title":"Twelfth Symposium on Usable Privacy and Security SOUPS.","author":"Wash Rick","year":"2016","unstructured":"Rick Wash , Emilee Rader , Ruthie Berman , and Zac Wellmer . 2016 . Understanding password choices: How frequently entered paswords are re-used across websites . In Twelfth Symposium on Usable Privacy and Security SOUPS. Rick Wash, Emilee Rader, Ruthie Berman, and Zac Wellmer. 2016. Understanding password choices: How frequently entered paswords are re-used across websites. In Twelfth Symposium on Usable Privacy and Security SOUPS."},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"crossref","unstructured":"Matt Weir Sudhir Aggarwal Michael Collins and Henry Stern. 2010. Testing metrics for password creation policies by attacking large sets of revealed passwords. In CCS.  Matt Weir Sudhir Aggarwal Michael Collins and Henry Stern. 2010. Testing metrics for password creation policies by attacking large sets of revealed passwords. In CCS.","DOI":"10.1145\/1866307.1866327"},{"key":"e_1_3_2_2_34_1","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Wheeler Daniel Lowe","year":"2016","unstructured":"Daniel Lowe Wheeler . 2016 . zxcvbn: Low-Budget Password Strength Estimation . In 25th USENIX Security Symposium (USENIX Security 16) . USENIX Association, Austin, TX, 157--173. Daniel Lowe Wheeler. 2016. zxcvbn: Low-Budget Password Strength Estimation. In 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, Austin, TX, 157--173."}],"event":{"name":"CCS '20: 2020 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event USA","acronym":"CCS '20","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3417882","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372297.3417882","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:01:31Z","timestamp":1750197691000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3417882"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,30]]},"references-count":34,"alternative-id":["10.1145\/3372297.3417882","10.1145\/3372297"],"URL":"https:\/\/doi.org\/10.1145\/3372297.3417882","relation":{},"subject":[],"published":{"date-parts":[[2020,10,30]]},"assertion":[{"value":"2020-11-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}