Characterizing and Detecting Password Guessing Attacks