Pushing on String: The 'Don't Care' Region of Password Strength. - FLORÊNCIO, DINEI; HERLEY, CORMAC; VAN OORSCHOT, PAUL C. (Communications of the ACM, 2016)
The article discusses the efficacy of methods for defending password-protected networks from guessing attacks, including enterprises that impose stringent password-composition policies. Topics include research suggesting that stringent passwords do not always reduce the likelihood of successful guessing attacks, the use of phishing email messages once an attacker has access to an internal account, and differences in the password strength required to resist online and offline guessing attacks.