Largest Study of its Kind Shows Outdated Password Practices are Widespread

Three out of four of the world’s most popular websites are failing to meet minimum requirement standards and allowing tens of millions of users to create weak passwords. The findings are part of a new Georgia Tech cybersecurity study that examines the current state of password policies across the internet.

Using a first-of-its-kind automated tool that can assess a website’s password creation policies, researchers also discovered that 12% of websites completely lacked password length requirements.

Assistant Professor Frank Li and Ph.D. student Suood Al Roomi in Georgia Tech’s School of Cybersecurity and Privacy created the automated assessment tool to explore all sites in the Google Chrome User Experience Report (CrUX), a database of one million websites and pages.  

Li and Al Roomi's method of inferring password policies succeeded on over 20,000 sites in the database and showed that many sites:

• Permit very short passwords
• Do not block common passwords
• Use outdated requirements like complex characters

The researchers also discovered that only a few sites fully follow standard guidelines, while most stick to outdated guidelines from 2004. The project was 135 times larger than previous works that relied on manual methods and smaller sample sizes.

More than half of the websites in the study accepted passwords with six characters or less, with 75% failing to require the recommended eight-character minimum. Around 12% of had no length requirements, and 30% did not support spaces or special characters.

Only 28% of the websites studied enforced a password block list, which means thousands of sites are vulnerable to cyber criminals who might try to use common passwords to break into a user’s account, also known as a password spraying attack.

“Both Professor Li and I were excited to take on the challenge,” said Al Roomi. “With his guidance and our continuous work on both algorithm design and the measurement technique, we were able to fully develop an automated measurement of password creation policy and apply it at scale.”

Al Roomi and Li designed an algorithm that automatically determines a website’s password policy. With the help of machine learning, the pair could see the consistency of length requirements and restrictions for numbers, upper- and lower-case letters, special symbols, combinations, and starting letters. They could also see if sites permitted dictionary words or known breached passwords.

“As a security community, we've identified and developed various solutions and best practices for improving internet and web security,” said Li. “It's crucial that we investigate whether those solutions or guidelines are actually adopted in practice to understand whether security is improving in reality.”

The project began during the height of the pandemic when Al Roomi found a gap in the research literature surrounding website password policies. Through his reading, he discovered that a consensus of his peers did not think a large-scale survey of password policies was possible due to the variety of web design.

“It was exciting to see an identified challenge in the literature and to develop and apply a vision we turned into the measurement tool,” said Al Roomi. “This research was my first in my Ph.D. program at Georgia Tech and SCP. It is one of the most challenging yet rewarding endeavors I've worked on.”

The full report will be presented at the ACM Conference on Computer and Communications Security (CCS) in Copenhagen, Denmark, later this month. A Large-Scale Measurement of Website Login Policies was also accepted to the 32nd USENIX Security Symposium earlier this year.