Password Requirements Markup Language

Abstract

Passwords are the most widely used authentication scheme for granting access to user accounts on the Internet. In order to choose strong passwords, security experts recommend the usage of password generators. However, automatically generated passwords often get rejected by services, because they do not fulfill the services’ password requirements. Users need to manually look up the password requirements for each individual service and configure the password generator accordingly. This inconvenience induces users not to employ password generators and rather stick to weak passwords. We present a solution that enables generators to automatically create passwords in accordance with services’ password requirements. First, we introduce the Password Requirements Markup Language (PRML). It enables uniformly specified Password Requirements Descriptions (PRDs) for services. PRDs can be automatically processed by password generators and allow the generation of strong valid passwords without user interaction. Second, we present a crawler for the automatized extraction of password requirements from services’ websites and the creation of the corresponding PRDs. This crawler allowed us to create PRDs of 72,124 services. Third, we describe a centralized and a decentralized approach for the provision of the PRDs to password generators. Finally, we present a password generator which uses PRDs and requires nothing but a service’ URL in order to generate a strong and valid password for the service.

Appendices

A Fictitious Example PRD

The PRD in Listing 1.1 defines the character sets lowercase letter, uppercase letters, numbers, special characters, and spaces. It requires that a password contains at least one special character and one number. Furthermore, the first character must be a lowercase letter. The password should not have more than 3 consecutive identical characters. The minimum password length is 10 and the maximum is 20 characters.

B Keywords

In the following appendix, we list the keywords that are used by the Keyword Annotator (cf. Sect. 4.1). The keywords are separated in three categories. First, keywords that are intended to find requirements with respect to the character sets. Second, usage verbs to interpret negation such as “do not use”. Third, keywords that focus on the minimum and maximum password length. We took the keywords from the password requirements of 20 websites and extended them by linguistically related words and terms (e.g. characters $\rightarrow$ character $\rightarrow$ chars $\rightarrow$ char).

Character Sets

• alphanumeric, alphanumeric characters

• characters, character, chars, char

• number, numbers, numeral, numerals, numeric character, numeric characters

• english characters, non-blank characters, letter, letters, alphabetic, alphabetic character, alphabetic characters

• lowercase, lowercase letter, lowercase letters, lowercase character, lowercase characters, lower case, lower case letter, lower case letters, lower case character, lower case characters

• uppercase, uppercase letter, uppercase letters, uppercase character, uppercase characters, upper case, upper case letter, upper case letters, upper case character, upper case characters, capital letter, capital letters, capital character, capital characters

• space, space character, space character, spaces, blanks, blank spaces, blank space

• special character, special characters, special char, special chars, symbol, symbols

• consecutive, repeat, repeated, sequences, same

Usage Verbs

• contain, include, use, have, exceed

Lengths

• minimum, min, at least, more than, longer than, or longer, or more

• maximum, max, less than, fewer than, at most, up to, or less

• exactly