Abstract:We examine the issue of password length leakage via encrypted traffic i.e., bicycle attacks. We aim to quantify both the prevalence of password length leakage bugs as well as the potential harm to users. In an observational study, we find that {\em most} of the Alexa top 100 rates sites are vulnerable to bicycle attacks meaning that an eavesdropping attacker can infer the exact length of a password based on the length the encrypted packet containing the password. We discuss several ways in which an eavesdropping attacker could link this password length with a particular user account e.g., a targeted campaign against a smaller group of users or via DNS hijacking for larger scale campaigns. We next use a decision-theoretic model to quantify the extent to which password length leakage might help an attacker to crack user passwords. In our analysis, we consider three different levels of password attackers: hacker, criminal and nation-state. In all cases, we find that such an attacker who knows the length of each user password gains a significant advantage over one without knowing the password length. As part of this analysis, we also release a new differentially private password frequency dataset from the 2016 LinkedIn breach using a differentially private algorithm of Blocki et al. (NDSS 2016) to protect user accounts. The LinkedIn frequency corpus is based on over 170 million passwords making it the largest frequency corpus publicly available to password researchers. While the defense against bicycle attacks is straightforward (i.e., ensure that passwords are always padded before encryption), we discuss several practical challenges organizations may face when attempting to patch this vulnerability. We advocate for a new W3C standard on how password fields are handled which would effectively eliminate most instances of password length leakage.

Personal Information Leakage During Password Recovery of Internet Services

Strong password? Not with your social network data!

Know their Customers: An Empirical Study of Online Account Enumeration Attacks

Using personal information to aid in guessing passwords of Chinese webs

A Large-Scale Empirical Study of Internet Users' Privacy Leakage in China.

Side-Channel Information Leakage of Traffic Data in Instant Messaging

Zero-Sum Password Cracking Game: A Large-Scale Empirical Study on the Crackability, Correlation, and Security of Passwords

A Spark is Enough in a Straw World: a Study of Websites Password Management in the Wild

Investigating Effectiveness of Informing Users About Breach Status of Their Email Addresses During Website Registration

Passwords and Perceptions.

Leakage or Identification: Behavior-irrelevant User Identification Leveraging Leakage Current on Laptops

Bicycle Attacks Considered Harmful: Quantifying the Damage of Widespread Password Length Leakage

Automated Detection of Password Leakage from Public GitHub Repositories

Information and Password Attacks on Social Networks: An Argument for Cryptography

Client-Server Password Recovery (Extended Abstract)

GDPArrrrr: Using Privacy Laws to Steal Identities

Password Correlation: Quantification, Evaluation and Application.

SoK: Web Authentication in the Age of End-to-End Encryption

Careless Whisper: Exploiting Stealthy End-to-End Leakage in Mobile Instant Messengers

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web

Research on Internet data security and privacy protection