Password research paper

Password Guidance. This paper provides Microsoft’s recommendations for password management based on current research and lessons from our own experience as one of the largest Identity Providers (IdPs) in the world. It covers recommendations for end users and identity administrators.

In this paper, we propose TSOTP: a new effective simple OTP method that generates a unique passcode for each use. The calculation uses both time stamps and sequence numbers. A two-factor authentication prototype for mobile phones using this method has been developed and has been used in practice for a year.

The password for the i th identification session, 1 i t, is defined to be w i = H t i ( w ). Its one disadv antage is the claimant’s high computation cost. This high comput ation requi rement makes the scheme unsuitable for devices with limited resources, e.g., mobile phones.

This gives us a unique vantage point to understand the role of passwords in account takeover. The guidance in this paper is scoped to users of Microsoft’s identity platforms (Azure Active Directory, Active Directory, and Microsoft account) though it generalizes to other platforms.