Lost in Disclosure: On the Inference of Password Composition Policies Largescale password data breaches are becoming increasingly commonplace, which has enabled researchers to produce a substantial body of password security research utilising realworld password datasets, which often contain numbers of records in the tens or even hundreds of millions. While much study has been conducted on how password composition policiesxe2x80x94sets of rules that a user must abide by when creating a passwordxe2x80x94influence the distribution of userchosen passwords on a system, much less research has been done on inferring the password composition policy that a given set of userchosen passwords was created under. In this paper, we state the problem with the naive approach to this challenge, and suggest a simple approach that produces more reliable results. We also present polinfer, a tool that implements this approach, and demonstrates its use in inferring password composition policies.

On the null relationship between personality types and passwords We performed a preliminary investigation of the relationship between the Bigfive personality traits and the strength of selected and created online security passwords. Fivehundred and ten participants were recruited through MTurk and asked a) to complete a Bigfive personality inventory, b) to select from a list of available passwords the one they felt was most secure, and c) to create unique, secure passwords for their own online protection. The security strength of participantsu0027 selectedcreated passwords was rated via Zxcvbn, and evaluated on a variety of additional securitybased criteria (e.g., password length, inclusion of special characters). In all cases results failed to identify significant relationship between the strength of the selectedchosen password and any Bigfive personality traits (when employing appropriately stringent control for multiple corrections). These null results suggest that other factors beyond an individualu0027s personality may hold greater influence over the strength of selectedcreated online passwords. We present detailed observations and findings from our experiment, discuss potential considerations for contradictions, and suggest possibilities for future research into the passwordpersonality relationship, including the potential use of enhanced password strength meters and tailored security nudges.