Abstract:While the computer security world has changed a lot over the last two decades, textual passwords remain the dominant authentication mechanism over the Internet and are likely to persist in the foreseeable future. Much attention (e.g., user surveys and empirical analysis) has been paid to passwords chosen by English users, yet relatively little is known about how nonEnglish users select passwords. In this work, we conduct so far the first user survey on the password behaviors of Chinese users, revealing a number of users’ basic coping strategies for managing passwords when they are confronted with the demanding tasks of keeping track of many accounts and passwords. We further perform an empirical analysis of 100 million Chinese web passwords in a comparison with 30 million English ones, a corpus among the largest ones ever studied. We identify a number of interesting structural and semantic characteristics in Chinese passwords, and also examine their security by employing two state-of-the-art password cracking techniques (i.e., probabilistic context-free grammars (PCFG) and Markov models). Particularly, our cracking results reveal a “reversal principle”: when the guess number allowed is small, Chinese passwords are much weaker than their English counterparts, yet this relationship will be reversed when the guess number is large. This well reconciles two conflicting claims about the strength of Chinese web passwords made by Bonneau in 2012 and Li et al. in 2014, respectively. At 10 guesses, the success rate of our improved PCFG-based attack against the Chinese datasets is from 33.2% to 49.8%, indicating that our attack can crack 92% to 188% more passwords than the best record reported by Li et al. in 2014. We also discuss the implications of our findings. This work is expected to help facilitate both security administrators and users to gain a better understanding of the vulnerability of Chinese passwords, as well as to shed light on future password research.

Word 2003 Document Password Cracking Based on the China Supercomputer

The Study of Password Security of Access 2010

Mangling Rules Generation with Density-Based Clustering for Password Guessing

Zero-Sum Password Cracking Game: A Large-Scale Empirical Study on the Crackability, Correlation, and Security of Passwords

Understanding Passwords of Chinese Users : A Survey and Empirical Analysis

Efficient Optimization of MS Office 2013+ Password Cracking and PBKDF2-HMAC-SHA2 on GPUs

A Novel Scheme of Information Hiding in Word2007 Document

Improved Wordpcfg for Passwords with Maximum Probability Segmentation

Advances in Password Security

Password Cracking and Countermeasures in Computer Security: A Survey

A Differential Power Analysis Attack on Dynamic Password Token Based on SM3 Algorithm

Digital forensics of Microsoft Office 2007–2013 documents to prevent covert communication

WebCrack: Dynamic Dictionary Adjustment for Web Weak Password Detection based on Blasting Response Event Discrimination

SE#PCFG: Semantically Enhanced PCFG for Password Analysis and Cracking

Understanding Offline Password-Cracking Methods: A Large-Scale Empirical Study

Chunk-Level Password Guessing: Towards Modeling Refined Password Composition Representations

Digit Semantics Based Optimization for Practical Password Cracking Tools.

Key Recovery Against 3DES in CPU Smart Card Based on Improved Correlation Power Analysis

Differential Power Analysis on Dynamic Password Token Based on SM3 Algorithm, and Countermeasures

Password Correlation: Quantification, Evaluation and Application.

WordMarkov: A New Password Probability Model of Semantics