DOI: 10.4231/r72v2d12
title: Longitudinal password data set varying with policy

description: &lt;p&gt;&lt;strong&gt;Purpose:&lt;/strong&gt;  This data set can be used to investigate the effect of password policies on real-world passwords created by users under a variety of policies over time.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Data set primary file(s):&lt;/strong&gt;&lt;/p&gt;

&lt;ul&gt;
 &lt;li&gt;INSURE_Password_strength_analysis_Dataset_Dark.csv&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;strong&gt;Year data were collected:&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;The data were collected in 2015.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Data set description:&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;The data were collected as part of a password coping mechanism study. There were a total of 2434 passwords collected over seven iterations across three policies (Curnett, 2015).&lt;/p&gt;

&lt;p&gt;The password policies included:&lt;/p&gt;

&lt;ul&gt;
 &lt;li&gt;Comprehensive 8 (C8):  The password must be at least 8 characters long and contain at least 1 capital letter, 1 special character, and 1 number. 806 passwords were collected with this policy (Kelley et al., 2012).&lt;/li&gt;
 &lt;li&gt;Blacklist Hard (BH):  The password must be at least 8 characters long and not be a word used in a 70000 word dictionary of commonly used words in the English language. 831 passwords were collected with this policy (Kelley et al., 2012).&lt;/li&gt;
 &lt;li&gt;Basic 16 (B16):  The password must be at least 16 characters long. 797 passwords were collected with this policy (Kelley et al., 2012).&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Summary statistics of passwords collected by iteration (I1-7) (Curnett, 2015):&lt;/p&gt;

&lt;p&gt;I1 - 1030; I2 - 496; I3 - 312; I4 - 250; I5 - 140; I6 - 116; I7 - 92.&lt;/p&gt;

&lt;p&gt;Summary statistics of passwords collected by policy (C8, BH, and B16) and iteration (I1-7) (Curnett, 2015):&lt;/p&gt;

&lt;ul&gt;
 &lt;li&gt;C8I1 - 335; C8I2 - 164; C813 - 107; C8I4 - 85; C8I5 - 47; C8I6 - 38; C8I7 - 30.&lt;/li&gt;
 &lt;li&gt;BHI1 - 343; BHI2 - 171; BHI3 - 107; BHI4 - 87; BHI5 - 49; BHI6 - 44; BHI7 - 30.&lt;/li&gt;
 &lt;li&gt;B16I1 - 350; B16I2 - 161; B16I3 - 98; B16I4 - 78; B16I5 - 44; B16I5 - 34; B16I6 - 34; B16I7 - 32.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;strong&gt;Data set supporting material(s):&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;The supporting materials included a definition list (INSURE_Definition_list_Supporting_materials_Dark.docx), a list of password policies and description (INSURE_Password_policies_Supporting_materials_Dark.docx), and specifications on the primary data set (INSURE_Specifications_Supporting_materials_Dark.xlsx).&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;References:&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;Curnett, B. (2015). Password Strength Analysis: User Coping Mechanisms in Password Selection. Purdue University.&lt;/p&gt;

&lt;p&gt;Kelley, P., Komanduri, S., Mazurek, M., Shay, R., Vidas, T., Bauer, L., Christin, N., Cranor, L., &amp; Lopez, J. (2012). Guess Again (and again and again): Measuring password strength by simulating password-cracking algorithms. IEEE Symposium on Security and Privacy (pp. 523-537). IEEE.&lt;/p&gt;
description: The data set included the participants' identification number (USER ID), the participants' assigned password policy identification number (POLICY ID), and seven iterations of passwords (PASSWORD 1-7).