# Password Guessability as a Service (PGaaS)
## 2 Background and Related Work
### Password Strength Estimators  
The work presented in [21] proposed a Password Strength Estimator that uses password ranking (PESrank), which according to authors models the behavior of powerful password crackers. It focuses on giving users feedback regarding the security ranking of the given password, which gives an idea to the person of how good or bad it is compared with others. PESrank returns the rank in fractions of a second to be helpful as an online tool. The authors showed that their tool could be modified to personalize the model used for ranking according to the application's particularities. The authors used a set of 905 million passwords to train the model. It is important to note that although it is a large set, situations might change such that the train sets no longer reflect the most current trends in password creation. Another work is presented in [22], where the authors proposed a lightweight and fast strength estimator, and the authors tested it on different platforms. They claimed that their tool is enough to predict best guessing attacks accurately and conservatively. The work presented in [23] created an estimator that trained against a leaked list of 14.3 million passwords. Such a list is used by password-cracking tools. The authors consider the importance of including leaked passwords in the estimation process to improve the accuracy of such tools. Although this tool is trained on a large dataset, it is still considered a tool that feeds from static information. Our work deals with this issue by relying on constantly updated datasets to adjust the estimations when needed. The authors of [24] presented a multi-modal password strength estimator where they combined unique techniques to exploit their advantages, thus overcoming the weaknesses of each. The authors stated the necessity of designing a flexible estimator that could adapt to the specification of each application environment, for example, how the language used for password creation should modify the tool's estimation. The concept of flexibility is critical in their proposal, but they tackle it from the application's perspective. On the other hand, our proposal assumes that strength estimation should change as password creation customs change. There is a trend concerning the design of lightweight estimators that could be deployed on light clients, such as that proposed in this paper. Such an example is presented in [25]. The authors proposed a light password strength estimator with an accuracy significantly higher than popular tools such as the zxcvbn [23]. In addition, their tool is light at 33 KB and as fast as 0.18 ms, making it suitable for light clients. This tool uses a method that measures password strength by evaluating the similarity between a password and a standard strong password as selected by their methods. The work presented in [18] presenteda neural-networks-based model that runs on JavaScript and is deployed on the clients' side without substantially affecting the accuracy of their algorithm. Their approach shows how researchers might decide to sacrifice accuracy when looking for lean implementations. However, our approach does not sacrifice accuracy while maintaining a light footprint at the running device, possible thanks to the microservice architecture design. The adaptability of estimators is put to the test when different languages are used. A particular study [26] showed the importance of adapting estimators to native languages, as the authors demonstrated in South Africa. This adaptation is one of the critical reasons behind the creation of our proposal, as language-adapted databases could improve the tool's accuracy. On the other hand, the work in [27] showed how demographics change the password creation process. It is expected that users with less Internet use proficiency might not be aware of the security issues derived from poor password creation.