Kamouflage: Loss-Resistant Password Management

Cheng

Proceedings 2018 Network and Distributed System Security Symposium

et al. 2018

Abstract-Honeywords are decoy passwords associated with each user account, and they contribute a promising approach to detecting password leakage. This approach was first proposed by Juels and Rivest at CCS'13, and has been covered by hundreds of medias and also adopted in various research domains. The idea of honeywords looks deceptively simple, but it is a deep and sophisticated challenge to automatically generate honeywords that are hard to differentiate from real passwords. In JuelsRivest's work, four main honeyword-generation methods are suggested but only justified by heuristic security arguments.In this work, we for the first time develop a series of practical experiments using 10 large-scale datasets, a total of 104 million real-world passwords, to quantitatively evaluate the security that these four methods can provide. Our results reveal that they all fail to provide the expected security: real passwords can be distinguished with a success rate of 29.29%∼32.62% by our basic trawling-guessing attacker, but not the expected 5%, with just one guess (when each user account is associated with 19 honeywords as recommended). This figure reaches 34.21%∼49.02% under the advanced trawling-guessing attackers who make use of various state-of-the-art probabilistic password models. We further evaluate the security of Juels-Rivest's methods under a targeted-guessing attacker who can exploit the victim' personal information, and the results are even more alarming: 56.81%∼67.98%. Overall, our work resolves three open problems in honeyword research, as defined by Juels and Rivest.

Section: A Review Of Juels-rivest's Methodsmentioning

confidence: 99%

A Security Analysis of Honeywords

Cheng

Proceedings 2018 Network and Distributed System Security Symposium

et al. 2018

“…Kamouflage is proposed as an architecture for building theft-resistant password managers [11]. It aims to protect local password database (e.g., stored on a laptop or a cell phone) by adding a list of statistically indistinguishable decoy passwords to hide the real list.…”

Section: Kamouflagementioning

confidence: 99%

Detecting Password File Theft using Predeﬁned Time-Delays between Certain Password Characters

Mahmoud¹,

Mansour²,

Makableh³

2017

JTIT

Abstract-This paper presents novel mechanisms that effectively detect password file thefts and at the same time prevent uncovering passwords. The proposed mechanism uses delay between consecutive keystrokes of the password characters. In presented case, a user should not only enter his password correctly during the sign-up process, but also needs to introduce relatively large time gaps between certain password characters. The proposed novel approaches disguise stored passwords by adding a suffix value that helps in detecting password file theft at the first sign-in attempt by an adversary who steals and cracks the hashed password file. Any attempt to login using a real password without adding the time delays in the correct positions may considered as an impersonation attack, i.e. the password file has been stolen and cracked.

“…[7] Password is "cat6light" then there are 3 letters, 1 digit and 5 letters, represented as L3+D1+L5. These characters are replaced by same syntax, here first 3 letters are replaced by random 3 letters then one digit replaced by random one digit and again 5 letters are replaced by 5 random letters.…”

Section: Chaffing By Tweaking Digitmentioning

confidence: 99%

Enhancing Security in user authentication through honeyword

Gadgil¹

2016

ijsrm

Honeyword system used to detect password file disclosure. For each user set of honeyword is generated. When adversary have a password file, then it get confused which one is real password in honeyword set. Adversary enters all honeywords in the set. When honeywords are entered notification will be send to the admin. Author gives hybrid method for generation of honeyword. Hybrid method provides strong DoS resistance and flatness.