#Segments: A Dominant Factor of Password Security to Resist against Data-driven Guessing. Issue 121 (October 2022)

• Record Type: Journal Article
• Authors: Wang, Chuanwang; Zhang, Junjie; Xu, Ming; Zhang, Haodong; Han, Weili
• Is Part Of: Computers & security. Issue 121(2022)
• Publication Date: 2022-10
• Subjects: Password security -- Data-driven guessing -- Segment -- Probabilistic context-free grammars -- Markov-based methods; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102848
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Understanding which factors dominate password security is vital for users to create their secure passwords. Prior works generally consider the password length and the number of character classes as the dominant factors. However, creating secure passwords based on the above two factors becomes much more challenging than before due to the emergence of powerful data-driven guessing methods, e.g., the Probabilistic Context-free Grammars (PCFG) and its variations, Markov-based methods, and neural-network-based methods. In this paper, inspired by the segments used in PCFG, where a segment is a continuous string whose characters have a strong correlation, we conduct a comprehensive empirical analysis and find that the number of segments (# Segments for short) is a dominant factor of password security to resist against data-driven guessing. That is, the increase of # Segments generally leads to a significant improvement of password security. The observation helps us explore an optimised identification method for segments, referred to as re-segment, which reduces # Segments as much as possible to obtain accurate # Segments by leveraging five popular patterns (i.e., keyboard, abbreviation, leet, mixture, and component ), to evaluate password security more accurately from an adversary's viewpoint. Then we propose an efficient data-driven guessing method, referred to as ReSeg-PCFG, by leveraging re-segment based on the latest version of PCFG. Our study shows that ReSeg-PCFG outperforms the state-of-the-art data-driven guessing methods in almost all scenarios; e.g., it outperforms the latest version of PCFG by up to 79.34 % at 10 14 guesses, a commonly used threshold of off-line attacks.