ErsatzPasswords

Using Amnesia to Detect Credential Database Breaches

“…In their proposal and works building on it (e.g., [14]), the target is augmented with a trusted honeychecker that stores which of the passwords listed with the account is the user-chosen one; login attempts with others alert the site to its breach. Almeshekah et al [2] use a machine-dependent function (e.g., hardware security module) in the password hash at the target site to prevent offline cracking of its credential database if breached. Of more relevance here, an attacker who is unaware of this defense and so attempts to crack its database offline will produce plausible decoy passwords (ersatzpasswords) that, when submitted, alert the target site to its breach.…”

“…Indeed, DeBlasio et al report that sites' unwillingness to trust the evidence they provided of the sites' breaches was an obstacle to getting them to act. 2 Moreover, the utility of artificial accounts hinges critically on their indistinguishability from real ones, and if methods using them became effective in hindering attacker activity, ensuring the indistinguishability of these accounts would presumably become its own arms race. Our design is agnostic to whether it is deployed on real or decoy accounts, sidestepping the need for convincing decoy accounts but also demanding attention to the risks to real accounts that it might introduce.…”

“…This assumption implies that any two invocations of HoneyGen(a, π a , k) produce sets a , a that intersect only in a with near certainty. Otherwise, an adversary B(a, a ) that invokes a ← HoneyGen(a, π a , k) and returns a random π ∈ π a \ {π a } would violate (2). In other words, (2) implies that the honeywords generated at two different sites for the same user's accounts are distinct, even if the user reuses the same password for both accounts.…”

A Hypergame Analysis for ErsatzPasswords

“…We define deceptive defense systems as software, personnel, data, or policies to deceive attackers and decrease their ability to succeed. Examples include honeypots [12], honeyfiles [15], honeywords [9], and ErsatzPasswords [1].…”

“…The EPW scheme [1] uses deception to protect salted password hashes (SHP) from offline brute-force attacks by modifying password hash creation. The term "ersatz password" can be interpreted as "fake passwords", i.e., not passwords of legitimate users in the system.…”