neural network using proactive password checking for java source code

You mean captcha or any other ? It's hard beacuse there is no golden rule for all.

What is the exact problem you are trying to solve?

It's not at all clear that a neural network is the best technological choice for solving the problem unless you state the exact problem you want to solve.

A neural network requires that you train it on a training set. To have a training set you already have to have a list of "weak" and "strong" passwords -- which means you have already figured out a way to decide if something is "weak" or "strong". If you already have that, why do need to create a neural network to do it?

Unless this is a homework assignment?

What do you mean by "weak" and "strong" -- I am continually amazed at the number of websites that enforce arbitrary rules that constrain your choice of passwords to something they consider "strong" when all that really does is reduce the actual number of passwords you can select, thus making it easier to brute force attack the site.

In actual fact if the passwords are properly hashed and salted, the only "weak" password is a common password.

Checking for common passwords doesn't require a neural network.

Having played around with AI a little, I just had a few thoughts reading this: You are right when you say that you don't need any AI when you have a well defined algorithm. Training the AI would be too much of an effort and at runtime the AI would just be wasteful when compared to an implementation of the algorithm.

Creating an AI becomes useful when there is no well defined algorithm or when the requirements change faster than you can update your implementation. Teaching a robot to walk can be such a problem. Basically it's just processing input from whatever sensors the robot has and moving the motors in the legs. Sounds simple, but gets very complicated if the robot encounters obstacles or uneven terrain.

I think you already have asked the right question: What constitutes a strong or weak password? By training the AI with sets of passwords which have proven themselves to be less safe, the AI may be able to judge passwords far better than any simple set of rules. His question may be far beyond the scope of Q&A, but it's not as foolish as you make it out to be.

I've played with AI alot. I studied it under Patrick Winston, and I helped develop one of the first commercially viable OCR programs.

A good definition of a "weak" password is: "one that is easily cracked".

"Easily cracked" is a matter of what methods a hacker is likely to use.

Assuming a site has correctly secured their passwords, the fastest methods of cracking a password are:

1. Find the piece of paper the person wrote the password down on.

2. Crack the non-existent security on some minor web site that makes you create a user name and password (and then stores it in plain text) and see if the person reused the password elsewhere.

3. Run through the list of most commonly used passwords.

4. Run through the dictionary.

5. ?

6. Brute force.

If a password isn't susceptible to methods 1 to 4, it's relatively strong.

After that, any other rules you enforce on a password actually makes a brute force attack easier.

If you want to apply AI to the problem, then the place to apply it is to intercept hacking attempts and find the patterns in those attempts.

The rules to include special characters, upper case and numbers aim at 3 and 4, but they also make brute force attacks less probable to succeed. Otherwise the hacker can always assume that most users are lazy enough to use relatively short passwords with only lower case letters or numbers. With this assumption the hacker would have to try a lower number of possible combinations to succeed.

Of course such rules limit the users to a finite subset of the infinite set of possible passwords, but are aimed at preventing the user from predictably limiting themselves to a even smaller set by lazyness, carelessness or ignorance.

On the other side, imposing too many rules on the passwords leads to the users having to write them down or reusing them, leading to 1 and 2.

Besides all this, locking the user's account for just one minute automatically after three wrong login attempts makes brute force attacks pointless. Assuming you allow only passwords with at least six lower case letters could take up to 71508 days to hack. For each password.

Absolutely right.