# Age and Gender Impact on Password Hygiene
## 3 Results
### Analysis of Dictionaries and Patterns  
Dictionaries sorted by word frequency have a substantial impact on the recovery speed (see Figure 2), as the curves representing the fraction of found passwords against their position in the dictionary drop faster than an exponential. Half (50%) of 8145 passwords found in the Rockyou dictionary are within the first 5% of its words. Similarly, half of the matched passwords are within the first 15% of the Lithuanian Top500k dictionary and within the first 20% of the Lithuanian Anthology dictionary. This finding also illustrates the persistence of the password reuse problem because the Rockyou breach occurred in another country a decade ago, but passwords of more than 7% of unique CityBee hashes are present in the dictionary. Quite often, the same password is used by many users. There are 17,328 records (15.71% of all records) with shared passwords. As a consequence, 14,206 users (12.88% of all users) have their passwords in the Rockyou dictionary. In total, passwords of 40,229 users (39.39%) were found in at least one of the previously leaked databases. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Length**} & \multicolumn{2}{c}{**All Records**} & \multicolumn{2}{c}{**Male**} & \multicolumn{2}{c}{**Female**} & \multicolumn{2}{c}{**Foreign/Unknown**} \\  & **Count** & **Proportion** & **Count** & **Proportion** & **Count** & **Proportion** & **Count** & **Proportion** \\ \hline
0 & 536 & 0.49\% & 322 & 0.45\% & 95 & 0.28\% & 119 & 2.54\% \\
1 & 1 & 0.001\% & 1 & 0.001\% & & & & \\
3 & 24 & 0.02\%  
Analysis of various patterns found in the recovered passwords is presented in Table 3. Each row independently lists a common pattern and the fraction of passwords observed among all recovered 102,120 passwords. Some patterns overlap. If a word from any dictionary listed in Table 1 is present somewhere in a password, then the password is assigned to the _word based_ pattern class. All others except the _digit only_ passwords are assigned to the _random_ class. Therefore, the measurements of the two classes are imprecise. Manual inspection shows that up to 25% of the supposedly _random_ passwords may have some semantic meaning, so it is difficult to determine the exact number of users who use password generators and managers. We had enumerated all the possible key-spaces of eight-character-long passwords and shorter using the 95 printable ASCII characters (including space). Therefore, we could extract the frequency distribution of all characters (see Table 4). Letter \(a\) is the most popular character both among the recovered passwords (with the frequency of 10.12%) and in password dictionaries Rocky(7.05%) and Top500k (10.64%). This is unusual, because the \begin{table}
\begin{tabular}{l c c} \hline \hline
**Class** & **Fraction** & **Example** & **Description** \\ \hline random & 21.45\% & 9q7F210 TkE & A sequence of random characters \\ digits only & 4.00\% & 1234500 & Any sequence of digits \\ \(\hookrightarrow\) phone & 0.75\% & 860012345 & Possibly a phone number \\ \(\hookrightarrow\) personal code & 0.10\% & State-issued code, 11 digits \\ date of birth & 1.24\% & me19720101 & User’s date of birth in any format \\ special symbol & 2.58\% & password! & At least one special character \\ spatial & 0.11\% & 1q2w3e & Keyboard walks \\ lowercase only & 23.82\% & apassword & a–z letters only \\ uppercase only & 0.09\% & PASSWORD & A–Z letters only \\ ULS pattern & 3.05\% & Password1 & One A–Z, then many a–z, then any non-letter \\ ULS+ pattern & 12.21\% & Password1! & One A–Z, then many a–z, then many non-letters \\ repeat & 5.19\% & Pass121212 & Repeated groups of one or more characters \\ word based & 74.55\% & Password123 & Some part is a dictionary word \\ \(\hookrightarrow\) name/email & 8.61\% & Someuser1! & User’s name or email \\ \(\hookrightarrow\) reversed name & 0.23\% & resUemoS123 & User’s name in reverse \\ \(\hookrightarrow\) I33t & \(\approx\) 1.5\% & P455w0 rd & L33 tsp34k, somewhat ambiguous \\ \hline \hline \end{tabular}
\end{table}