Modeling the Adversary to Evaluate Password Strength With Limited Samples