  The choice of password composition policy to enforce on a password-protected
system represents a critical security decision, and has been shown to
significantly affect the vulnerability of user-chosen passwords to guessing
attacks. In practice, however, this choice is not usually rigorous or
justifiable, with a tendency for system administrators to choose password
composition policies based on intuition alone. In this work, we propose a novel
methodology that draws on password probability distributions constructed from
large sets of real-world password data which have been filtered according to
various password composition policies. Password probabilities are then
redistributed to simulate different user password reselection behaviours in
order to automatically determine the password composition policy that will
induce the distribution of user-chosen passwords with the greatest uniformity,
a metric which we show to be a useful proxy to measure overall resistance to
password guessing attacks. Further, we show that by fitting power-law equations
to the password probability distributions we generate, we can justify our
choice of password composition policy without any direct access to user
password data. Finally, we present Skeptic -- a software toolkit that
implements this methodology, including a DSL to enable system administrators
with no background in password security to compare and rank password
composition policies without resorting to expensive and time-consuming user
studies. Drawing on 205,176,321 pass words across 3 datasets, we lend validity
to our approach by demonstrating that the results we obtain align closely with
findings from a previous empirical study into password composition policy
effectiveness.
