# Password Guessability as a Service (PGaaS)
## 1 Introduction  
Online passwords security is an ongoing security problem due to constant attacks on online exposed services and the lack of safe behavior from users while connecting to those services, especially when users need to create and protect their passwords. Password guesser tools are improving their capabilities, and nowadays, attackers do not need large leaks to guess the rest of the passwords [1]. Although today, multi-factor authentication systems have emerged as a more secure alternative, password authentication remains either as the only factor used by many users or as one of the factors of multi-factor systems [2]. Any online information system must have an appropriate security level to prevent an intruder from accessing the information. Users tend to choose their passwords as combinations of characters that are easy for them to remember, such as names, dates, and phone numbers, regardless of how vulnerable passwords can be or of their knowledge about how passwords might be cracked [3, 4]. As a result, attackers or hackers use techniques and tools for breaching and cracking passwords [5]. This problem represents a vulnerability to be exploited. Security companies have implemented mechanisms to improve password security. Passwords must have two fundamental properties: (1) be hard to guess, to make them secure against brute-force attackers and (2) be easy to remember, so users do not rely on third-party tools to remember them. Therefore, it is necessary to develop a tool that allows the users to know how secure their password is, i.e., a tool a user can utilize for estimating the strength of a chosen password. Additionally, such a tool should leverage the best available resources to give the appropriate feedback to the users. As evidenced by the literature discussed in Section 2, a large number of current password-strength estimators employ large but static and context-unaware password datasets and present limited usability. The desired tool should be built on two premises: (1) learn from frequently updated datasets to reflect changes in users' predilections for password creation, and at the same time (2) give feedback about how common or secure a tested password is. There are some well-known password-guessing tools such as John the Ripper [6], and Hashcat [7]. Such tools, however, are not easily integrated as a service for companies and other services to integrate into their software. Part of a good password security validation tool is the database it uses to feed its algorithm before evaluating the given password and the algorithm used to validate it. The proposal from [8] called PassGAN uses neural networks to create valuable databases, and the algorithm in PESrank [9] ranks the given password as feedback to the user. The tools mentioned above offer excellent approaches to both problems but do not mix their solutions for an optimal approach. For this reason, this paper proposes a mechanism and architecture to strengthen passwords by measuring their degree of strength to reduce the vulnerabilities that arise from malicious attacks. The proposal creates a set of passwords with human characteristics and classifies user passwords by their strength, respectively. This paper aims to build an architecture with modular components that include models and password-generation algorithms. It will train models to generate dictionaries of passwords consistent with business systems. The main contributions of this paper are the following:  
* The first adaptable password guessability service offered as a cloud-based service to benefit from all the features and goals expected for cloud applications, e.g., scalability and availability. In particular, this paper presents a flexible cloud-based software architecture engineered to provide an efficient and robust guessability service.