Abstract:While the computer security world has changed a lot over the last two decades, textual passwords remain the dominant authentication mechanism over the Internet and are likely to persist in the foreseeable future. Much attention (e.g., user surveys and empirical analysis) has been paid to passwords chosen by English users, yet relatively little is known about how nonEnglish users select passwords. In this work, we conduct so far the first user survey on the password behaviors of Chinese users, revealing a number of users’ basic coping strategies for managing passwords when they are confronted with the demanding tasks of keeping track of many accounts and passwords. We further perform an empirical analysis of 100 million Chinese web passwords in a comparison with 30 million English ones, a corpus among the largest ones ever studied. We identify a number of interesting structural and semantic characteristics in Chinese passwords, and also examine their security by employing two state-of-the-art password cracking techniques (i.e., probabilistic context-free grammars (PCFG) and Markov models). Particularly, our cracking results reveal a “reversal principle”: when the guess number allowed is small, Chinese passwords are much weaker than their English counterparts, yet this relationship will be reversed when the guess number is large. This well reconciles two conflicting claims about the strength of Chinese web passwords made by Bonneau in 2012 and Li et al. in 2014, respectively. At 10 guesses, the success rate of our improved PCFG-based attack against the Chinese datasets is from 33.2% to 49.8%, indicating that our attack can crack 92% to 188% more passwords than the best record reported by Li et al. in 2014. We also discuss the implications of our findings. This work is expected to help facilitate both security administrators and users to gain a better understanding of the vulnerability of Chinese passwords, as well as to shed light on future password research.

Measuring Website Password Creation Policies At Scale

The Emperor's New Password Creation Policies.

A Measurement Study of Authentication Rate-Limiting Mechanisms of Modern Websites

The Emperor'S New Password Creation Policies: An Evaluation Of Leading Web Services And The Effect Of Role In Resisting Against Online Guessing

Studying the Impact of Managers on Password Strength and Reuse

User Practice in Password Security: an Empirical Study of Real-Life Passwords in the Wild

A Spark is Enough in a Straw World: a Study of Websites Password Management in the Wild

Evaluation of Secure OpenID-Based RAAA User Authentication Protocol for Preventing Specific Web Attacks in Web Apps

DPPG: A Dynamic Password Policy Generation System

A Study of Password Security Factors among Bangladeshi Government Websites

Shadow Attacks Based on Password Reuses: A Quantitative Empirical Analysis

That Was Then, This Is Now: A Security Evaluation of Password Generation, Storage, and Autofill in Thirteen Password Managers

"Make Them Change it Every Week!": A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication

Password security: Password behavior analysis at a small university

The Effect of Domain Terms on Password Security

Improving Users' Passwords with DPAR: a Data-driven Password Recommendation System

Automated Password Extraction Attack on Modern Password Managers

Understanding Passwords of Chinese Users : A Survey and Empirical Analysis

A Large-Scale Survey of Password Entry Practices on Non-Desktop Devices

An Explainable Password Strength Meter Addon Via Textual Pattern Recognition.

Evaluating Password Advice