Passwords and power laws
According to this paper [1], the empirical distribution of real passwords follows a power law [2]. In the authors' terms, a Zipf-like distribution. The frequency of the rth most common password is proportional to something like 1/r. More precisely,
fr = C r-s
where s is on the order of 1. The value of s that best fit the data depended on the set of passwords, but their estimates of s varied from 0.46 to 0.91.
This means that the most common passwords are very common and easy to guess.
Size of password spacesIf passwords come from an alphabet of size A and have length n, then there are An possibilities. For example, if a password has length 10 and consists of uppercase and lowercase English letters and digits, there are
6210 = 839,299,365,868,340,224
possible such passwords. If users chose passwords randomly from this set, brute force password attacks would be impractical. But brute force attacks are practical because passwords are not chosen uniformly from this large space of possibilities, far from it.
Attackers do not randomly try passwords. They start with the most common passwords and work their way down the list. In other words, attackers use Pareto's rule.
Rules requiring, say, one upper case letter, don't help much because most users will respond by using exactly one upper case letter, probably the first letter. If passwords must have one special character, most people will use exactly one special character, most likely at the end of the word. Expanding the alphabet size A exponentially increases the possible passwords, but does little to increase the actual number of passwords.
What's interesting about the power law distribution is that there's not a dichotomy between naive and sophisticated users. If there were, there would be a lot of common passwords, and all the rest uniformly distributed. Instead, there's a continuum between the most naive and most sophisticated. That means a lot of people are not exactly naive, but not as secure as they think they are.
Some mathUnder the Zipf model [3], the number of times we'd expect to see the most common password is NC where N is the size of the data set. The constant C is what it has to be for the frequencies to sum to 1. That is, C depends on the number of data points N and the exponent s and is given by
We can bound the sum in the denominator from above and below with integrals, as in the integral test for series convergence. This gives us a way to see more easily how C depends on its parameters.
When s = 1 this reduces to
and otherwise to
Suppose you have N = 1,000,000 passwords. The range of s values found by Wang et al varied from roughly 0.5 to 0.9. Let's first set s = 0.5. Then C is roughly 0.0005. This mean the most common password appears about 500 times.
If we keep N the same and set s to 0.9, then C is roughly 0.033, and so the most common password would appear about 33,000 times.
How to choose passwordsIf you need to come up with a password, randomly generated passwords are best, but hard to remember. So people either use weak but memorable passwords, or use strong passwords and don't try to remember them. The latter varies in sophistication from password management software down to Post-it notes stuck on a monitor.
One compromise is to concatenate a few randomly chosen words. Something like "thebestoftimes" would be weak because they are consecutive words from a famous novel. Something like "orangemarbleplungersoap" would be better.
Another compromise, one that takes more effort than most people are willing to expend, is to use Manuel Blum's mental hash function.
Related posts[1] In case the link rots in the future, the paper is "Zipf's Law in Passwords" by Ding Wang, Haibo Cheng, Ping Wang, Xinyi Huang, and Gaopeng Jian. IEEE Transactions on Information Forensics and Security, vol. 12, no. 11, November 2017.
[2] Nothing follows a power law distribution exactly and everywhere. But that's OK: nothing exactly follows any other distribution everywhere: not Gaussian, not exponential, etc. But a lot of things, like user passwords, approximately follow a power law, especially over the middle of their range. Power law's like Zipf's law tend to not fit as well at the beginning and the end.
[3] Here I'm using a pure Zipf model for simplicity. The paper [1] used a Zipf-like model that I'm not using here. Related to the footnote [2] above, it's often necessary to use a minor variation on the pure Zipf model to get a better fit.