[Submitted on 18 Jan 2023 (v1), last revised 27 Apr 2023 (this version, v3)]
Abstract: We introduce the concept of “universal password model” — a password model
that, once pre-trained, can automatically change its guessing strategy based on
the target system. To achieve this, the model does not need to access any
plaintext passwords from the target credentials. Instead, it exploits users’
auxiliary information, such as email addresses, as a proxy signal to predict
the underlying pa
