  Password security hinges on an in-depth understanding of the techniques
adopted by attackers. Unfortunately, real-world adversaries resort to pragmatic
guessing strategies such as dictionary attacks that are inherently difficult to
model in password security studies. In order to be representative of the actual
threat, dictionary attacks must be thoughtfully configured and tuned. However,
this process requires a domain-knowledge and expertise that cannot be easily
replicated. The consequence of inaccurately calibrating dictionary attacks is
the unreliability of password security analyses, impaired by a severe
measurement bias.
  In the present work, we introduce a new generation of dictionary attacks that
is consistently more resilient to inadequate configurations. Requiring no
supervision or domain-knowledge, this technique automatically approximates the
advanced guessing strategies adopted by real-world attackers. To achieve this:
(1) We use deep neural networks to model the proficiency of adversaries in
building attack configurations. (2) Then, we introduce dynamic guessing
strategies within dictionary attacks. These mimic experts' ability to adapt
their guessing strategies on the fly by incorporating knowledge on their
targets.
  Our techniques enable more robust and sound password strength estimates
within dictionary attacks, eventually reducing overestimation in modeling
real-world threats in password security. Code available:
https://github.com/TheAdamProject/adams
