On Designing a Questionnaire Based Honeyword Generation Approach for Achieving Flatness

Abstract

Modern trend sees a lot usage of honeywords (or fake password) for protecting the original passwords in the password file. However, the usage of honeywords has strongly been criticized under the different security and usability parameters. Though many of these issues have been successfully resolved, research in this domain is still facing difficulties in achieving flatness (or producing the equally probable honeywords with reference to the original password). Though recent studies have made a significant effort to meet this criterion, we show that they either fall short or are based on some unrealistic assumptions. To practically fulfil this flatness criterion, we propose a questionnaire-oriented authentication system based on the episodic (or long term) memory of the users. Our study reveals that proposed mechanism is capable of generating significantly improved flatter list of honeywords compared to the existing protocols. Subsequent discussion shows that the proposed system also overcomes all the limitations of the existing state of arts with no lesser than 95% goodness.

HoneyTree: Making Honeywords Sweeter

“…However, in reality, the probabilities of all the sweetwords are not necessarily equally flat. This brings us to the problem of flatness which measures how equally likely each of the sweetwords appears [4,10]. By using passive information or techniques like pattern recognition, some of the sweetwords can be eliminated, and the list can be narrowed down.…”

“…A lot of the works built on the foundation of the Honeywords project focus on qualitative advancement, which involves improving the mechanism of generating plausible passwords or achieving flatness. This is mostly done using either surveys [10] or using Deep Adversarial Neural Network-based models like PassGAN [11]. The number of honeywords can also be increased to achieve better security.…”

HoneyGen: Generating Honeywords Using Representation Learning

“…The Honeywords Generation Problem. Generating honeywords is a challenging problem mainly due to the various assumptions about the knowledge of the adversary as well as the passwordselection behaviour of human users [7,9,14,17,22]. The success of HGTs lies on the quality of the resulting honeywords; the method fails if an adversary can easily distinguish the real password from the honeywords [22].…”

Password Guessing-Based Legacy-UI Honeywords Generation Strategies for Achieving Flatness

“…The most challenging part for the system administrator to implement the honeywords system is how to create the decoy passwords that fulfill the security and usability standards of the system [9], [10]. Unfortunately, usability and security often collide with each other so that the two standards cannot be met [9]. Based on whether there is a modification on the user interface (UI) for password change, the honeywords generation methods can be divided into two classes: the legacy-UI and the modified-UI approach.…”

“…Moreover, some modified-UI based methods (e.g. take-a-tail in [7]) sometime become unusable in practice [9]. Therefore, legacy-UI is more recommended due to its high usability.…”