Abstract:"Honeywords" have emerged as a promising defense mechanism for detecting data breaches and foiling offline dictionary attacks (ODA) by deceiving attackers with false passwords. In this paper, we propose PassFilter, a novel deep learning (DL) based attack framework, fundamental in its ability to identify passwords from a set of sweetwords associated with a user account, effectively challenging a variety of honeywords generation techniques (HGTs). The DL model in PassFilter is trained with a set of previously collected or adversarially generated passwords and honeywords, and carefully orchestrated to predict whether a sweetword is the password or a honeyword. Our model can compromise the security of state-of-the-art, heuristics-based, and representation learning-based HGTs proposed by Dionysiou et al. Specifically, our analysis with nine publicly available password datasets shows that PassFilter significantly outperforms the baseline random guessing success rate of 5%, achieving 6.10% to 52.78% on the 1st guessing attempt, considering 20 sweetwords per account. This success rate rapidly increases with additional login attempts before account lock-outs, often allowed on many real-world online services to maintain reasonable usability. For example, it ranges from 41.78% to 96.80% for five attempts, and from 72.87% to 99.00% for ten attempts, compared to 25% and 50% random guessing, respectively. We also examined PassFilter against general-purpose language models used for honeyword generation, like those proposed by Yu et al. These honeywords also proved vulnerable to our attack, with success rates of 14.19% for 1st guessing attempt, increasing to 30.23%, 41.70%, and 63.10% after 3rd, 5th, and 10th guessing attempts, respectively. Our findings demonstrate the effectiveness of DL model deployed in PassFilter in breaching state-of-the-art HGTs and compromising password security based on ODA.

Improving Real-world Password Guessing Attacks via Bi-directional Transformers

PagPassGPT: Pattern Guided Password Guessing via Generative Pretrained Transformer

Protego: Detecting Adversarial Examples for Vision Transformers Via Intrinsic Capabilities

Chunk-Level Password Guessing: Towards Modeling Refined Password Composition Representations

Passtrans: an Improved Password Reuse Model Based on Transformer

Mangling Rules Generation with Density-Based Clustering for Password Guessing

PassTSL: Modeling Human-Created Passwords through Two-Stage Learning

TransPCFG : Transferring the Grammars From Short Passwords to Guess Long Passwords Effectively

Corpora-based Password Guessing: an Efficient Approach for Small Training Sets

Targeted Online Password Guessing

A New Targeted Password Guessing Model.

Modified Password Guessing Methods Based on TarGuess-I

Password guessers under a microscope: an in-depth analysis to inform deployments

A New Targeted Online Password Guessing Algorithm Based on Old Password.

#Segments: A Dominant Factor of Password Security to Resist against Data-driven Guessing

A Neural Attack Model for Cracking Passwords in Adversarial Environments

Reducing Bias in Modeling Real-world Password Strength via Deep Learning and Dynamic Dictionaries

Using personal information to aid in guessing passwords of Chinese webs

PassTCN-PPLL: A Password Guessing Model Based on Probability Label Learning and Temporal Convolutional Neural Network

Digit Semantics Based Optimization for Practical Password Cracking Tools.

When AI Defeats Password Deception! A Deep Learning Framework to Distinguish Passwords and Honeywords