Password security warning system
Various embodiments are directed to a password security warning system. An artificial neural network or other types of models may be used to determine whether a password that is created, input, or proposed by a user via an interface includes one or more predictable or typical transformations or combinations of characters derived from user-specific information. Based on the determination, a warning may be provided to the user.
1. An apparatus comprising:
at least one memory storing instructions;
one or more processors, operably coupled to the at least one memory, operable to execute the instructions that, when executed by the one or more processors, cause the one or more processors to:
determine one or more patterns associated with combinations of at least: first personal information and second personal information different from the first personal information typical or predictable in weak passwords;
determine a user-specific pattern of passwords specific to a user, the user-specific pattern not general to a population of users;
train a neural network based at least in part on: a plurality of typical or predictable password transformations comprising at least one replacement of a letter with an associated special character, the one or more patterns of the combinations of at least the first and second personal information, the user-specific pattern, and a plurality of blacklisted passwords, the trained neural network configured to output a plurality of possible password strings unique to the user in response to user-specific information associated with the user provided to the neural network;
receive a password created by the user;
determine whether the password matches at least one possible password string of the plurality of possible password strings based on a threshold match; and
provide a warning that the password is unsafe or insecure in response to the password matching the at least one possible password string.
2. The apparatus of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:
receive user-specific information associated with the user;
provide the received user-specific information to the neural network, and
wherein the neural network is trained using the provided user-specific information.
3. The apparatus of claim 2 , wherein the plurality of possible password strings output by the neural network comprises at least one or more typical or predictable transformations of the user-specific information and one or more typical or predictable combinations of the user-specific information.
4. The apparatus of claim 2 , wherein the user-specific information is provided by the user and comprises one or more of the following: a legal first name, a legal middle name, a legal last name, a nickname, a date of birth, a social security number, a home address, a work address, a telephone number, spousal information, and/or a maiden name.
5. The apparatus of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:
perform an Internet search on the user and provide one or more results of the Internet search to the neural network,
wherein the one or more results of the Internet search comprises information associated with user from a social media account, a professional networking profile, a professional profile webpage, a blog, an online dating profile, a public article, and/or an image, and
wherein the one or more results of the Internet search comprises one or more of the following: a pet name, a hobby, information related to a profession, a high school, a college or university, a graduate school, and/or a favorite vacation destination.
6. The apparatus of claim 1 , wherein the plurality of typical or predictable password transformations comprises one or more of the following: combination of two or more character strings, formatting at least one character in the character string differently, and/or arranging the two or more character strings in a sequence.
7. The apparatus of claim 1 , wherein the user-specific pattern is determined based on an identification of a specific pattern used in previous passwords of the user.
8. The apparatus of claim 1 , the instructions, when executed by the one or more processors, further cause the one or more processors to:
receive at least one compromised password determined to have been cracked or compromised; and
add the at least one compromised password to the plurality of blacklisted passwords for updating the training of the neural network to include cracked and compromised passwords.
9. A method comprising:
determining, via one or more processors, one or more patterns associated with combinations of at least: first personal information and second personal information different from the first personal information typical or predictable in weak passwords;
determining a user-specific pattern of passwords specific to a user, the user-specific pattern not general to a population of users;
training, via the one or more processors, a neural network based at least in part on: a plurality of typical or predictable password transformations comprising at least one replacement of a letter with an associated special character, the one or more patterns of the combinations of at least the first and second personal information, the user-specific pattern, and a plurality of blacklisted passwords, the trained neural network configured to output a plurality of possible password strings unique to the user in response to user-specific information associated with the user provided to the neural network;
receiving a password created by the user;
determining, via the one or more processors, whether the password matches at least one possible password string of the plurality of possible password strings based on a threshold match; and
providing a warning that the password is unsafe or insecure in response to the password matching the at least one possible password string.
10. The method of claim 9 , further comprising:
receiving user-specific information associated with the user;
providing the received user-specific information to the neural network, and
wherein the neural network is trained using the provided user-specific information.
11. The method of claim 10 , wherein the user-specific information is provided by the user and comprises one or more of the following: a legal first name, a legal middle name, a legal last name, a nickname, a date of birth, a social security number, a home address, a work address, a telephone number, spousal information, and/or a maiden name.
12. The method of claim 9 , wherein the plurality of typical or predictable password transformations comprises one or more of the following: combination of two or more character strings, formatting at least one character in the character string differently, and/or arranging the two or more character strings in a sequence.
13. The method of claim 9 , wherein the user-specific pattern is determined based on an identification of a specific pattern used in previous passwords of the user.
14. The method of claim 9 , further comprising:
receiving at least one compromised password determined to have been cracked or compromised; and
adding the at least one compromised password to the plurality of blacklisted passwords for updating the training of the neural network to include cracked and compromised passwords.
15. At least one non-transitory computer-readable storage medium storing program code executable by at least one processor to:
determine one or more patterns associated with combinations of at least: first personal information and second personal information different from the first personal information typical or predictable in weak passwords;
determine a user-specific pattern of passwords specific to a user, the user-specific pattern not general to a population of users;
train a neural network based at least in part on: a plurality of typical or predictable password transformations comprising at least one replacement of a letter with an associated special character, the one or more patterns of the combinations of at least the first and second personal information, the user-specific pattern, and a plurality of blacklisted passwords, the trained neural network configured to output a plurality of possible password strings unique to the user in response to user-specific information associated with the user provided to the neural network;
receive a password created by the user;
determine whether the password matches at least one possible password string of the plurality of possible password strings based on a threshold match; and
provide a warning that the password is unsafe or insecure in response to the password matching the at least one possible password string.
16. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the stored program code causes the at least one processor to:
receive user-specific information associated with the user;
provide the received user-specific information to the neural network, and
wherein the neural network is trained using the provided user-specific information.
17. The at least one non-transitory computer-readable storage medium of claim 16 , wherein the user-specific information is provided by the user and comprises one or more of the following: a legal first name, a legal middle name, a legal last name, a nickname, a date of birth, a social security number, a home address, a work address, a telephone number, spousal information, and/or a maiden name.
18. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the plurality of typical or predictable password transformations comprises one or more of the following: combination of two or more character strings, formatting at least one character in the character string differently, and/or arranging the two or more character strings in a sequence.
19. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the user-specific pattern is determined based on an identification of a specific pattern used in previous passwords of the user.
20. The at least one non-transitory computer-readable storage medium of claim 15 , wherein the stored program code causes the at least one processor to:
receive at least one compromised password determined to have been cracked or compromised; and
add the at least one compromised password to the plurality of blacklisted passwords for updating the training of the neural network to include cracked and compromised passwords.