# Strength Analysis of Real-Life Passwords Using Markov Models
## 5 Results
### Main Results  
Each model produced 11,924,618 results. Table 5 shows the descriptive statistics for the results of all 12 models. From it we can quickly notice some distinguishable differences between the models. The mean values range from 132.99 to 3003.56, medians are between 120.22 and 4000.00, and standard deviations range from 95.21 to 1895.30. All of these differences are very big and at least one reason for this can be seen in the mode statistic. The mode of all models is 4000. This is not surprising as the models assign this value to passwords for which they are unable to calculate the strength. As the passwords that could not have their strength calculated are considered to be stronger than the rest we assigned them the highest value. In our case the value 4000 acts similarly to a ceiling value, resulting in a distribution with a ceiling effect (which, in turn, compromises the normal distribution of the models). An example of this can be seen in Figure 3. Figure 3 shows the distribution of _myspace_ model. In the right part of the graph, we can see the large increase in the frequency of the ceiling value. All models produce such an effect to a greater or lesser degree. Even though the mode of all the models is 4000 it might pay to take a closer look at the frequency of this value in different models. After all the _scribd_ model has a median that is the same as the ceiling value, meaning more than half the results outputted by this model were 4000. High  
Figure 3: Distribution histogram for the myspace model. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Mean** & **Median** & **Mode** & **Std. Deviation** & **Maximum** \\ \hline
10\_million\_passwords & 146.26 & 120.22 & 4000 & 257.99 & 4000 \\
10k\_most\_common & 1074.47 & 126.20 & 4000 & 1671.79 & 4000 \\ faithwriters & 1286.00 & 141.36 & 4000 & 1772.61 & 4000 \\ hotmail & 632.37 & 127.12 & 4000 & 1303.92 & 4000 \\ myspace & 487.87 & 132.53 & 4000 & 1111.33 & 4000 \\ passwords & 1656.88 & 161.35 & 4000 & 1895.30 & 4000 \\ phpbb & 174.87 & 128.49 & 4000 & 381.38 & 4000 \\ rockyou & 132.99 & 120.69 & 4000 & 95.21 & 4000 \\ scribd & 3003.56 & 4000.00 & 4000 & 1690.55 & 4000 \\ singles\_org & 750.01 & 127.06 & 4000 & 1425.36 & 4000 \\ tuscl & 427.66 & 127.33 & 4000 & 1027.52 & 4000 \\ uniqpass & 657.80 & 126.40 & 4000 & 1332.94 & 4000 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Descriptive statistics for the password strengths produced by the 12 models. frequencies of such values could also mean a bad training dataset that was not able to accurately measure the strength of passwords from the testing dataset. Many ceiling values would inflate the average statistics and the standard deviation. We can see this is in Figure 4, where the number of ceiling values that each model produces is shown. Comparison between Table 5 and Figure 4 indicates that the size of the mean is connected with the number of ceiling values each model produces-the order of models, sorted by their mean size is the same as the order of models when sorted by the number of ceiling values. This will probably be the most important defining characteristic of successful models, because of the way we define a good password checking model. The best model is the one that is the most severe with the passwords it is checking (i.e., it produces the smallest values) because when dealing with the security we should always be prepared for the worst-case scenario. An excessively stringent model promotes the use of safer passwords, while an overly mild model gives good marks to less desirable passwords and creates false confidence in those passwords. Models with more ceiling values will on average and when compared, value by value, to another model be more prone to show higher password strengths and will therefore be determined to be less desirable for evaluation of password strengths. When comparing models by their frequency of ceiling values (Figure 4), we can notice large differences between them.