Global disparities in password security: An empirical analysis of 1.3 billion credentials using the password security index (PSI)

초록

Passwords remain the most prevalent authentication method, yet their security implications vary drastically across different geopolitical and institutional landscapes. Existing studies often lack the scale or unified methodology required to measure these differences globally. To address this gap, this study analyzes 1.3 billion cleaned password records from the 'Collection #1' breach, systematically classifying them into 69 targets spanning 56 countries and 6 organizational generic top-level domains (gTLDs). We introduce the Password Security Index (PSI), a novel composite metric that integrates structural composition, password length, and algorithmic guess-ability estimates (zxcvbn) to quantify security posture. Our findings reveal significant disparities: institutional domains (e.g., .gov) exhibit high complexity yet remain vulnerable to guessing due to predictable patterns. In contrast, regional habits persistently favor simple numeric or alphabetic strings, highlighting the insufficiency of standard complexity mandates. By categorizing targets into five security tiers via PSI-based clustering, this work provides a reproducible framework for benchmarking password security and offers data-driven insights for refining security policies and cross-cultural training programs.

키워드