NDLI: Regional Patterns and Vulnerability Analysis of Chinese Web Passwords

Content Provider	IEEE Xplore Digital Library
Author	Weili Han Zhigong Li Lang Yuan Wenyuan Xu
Copyright Year	2005
Abstract	Current research on password security pays much attention on users who speak Indo-European languages (English, Spanish, and so on), and thus the countermeasures are heavily influenced by Indo-European speakers' choices as well. However, languages have a strong impact on passwords. Analysis without considering other languages (e.g., Chinese) might lead to some biased results, such as Chinese passwords are one of the most difficult ones to guess. We believe that such a conclusion could be biased because, to the best of our knowledge, little empirical study has examined the regional differences of passwords at a large scale, especially on Chinese passwords. In this paper, we comprehensively study the differences between passwords from Chinese and English-dominant users, leveraging over 100 million leaked and publicly available passwords from Chinese and international websites in recent years. We find that Chinese prefer digits when composing their passwords, while English-dominant users prefer letters, especially lowercase letters. However, their strength against password guessing is similar. Second, we observe that both groups of users prefer to use the patterns that they are familiar with, e.g., Chinese Pinyins for Chinese and English words for English-dominant users. In particular, since multiple input methods require various sequences of letters to enter the same Chinese characters, we evaluate the impacts of various Chinese input methods, in addition to Pinyin. Third, we observe that both Chinese and English-dominant users prefer their conventional format when they use dates to construct passwords. Based on these observations, we improve two password guessing methods: 1) probabilistic context-free grammar (PCFG)-based password guessing method and 2) Markov model-based password guessing method. For the PCFG-based method, the guessing efficiency increases by up to 48% after inserting Pinyins (about 2.3% more entries) into the attack dictionary and inserting the observed composition rules into the guessing rule set. For the Markov-model-based method, the guessing efficiency increases by up to 4.7% after we increase the percentage of Pinyins in the training set. Our research sheds light on understanding the impact of regional patterns on passwords.
Sponsorship	IEEE Signal Processing Society
Starting Page	258
Ending Page	272
Page Count	15
File Size	3515553
File Format	PDF
ISSN	15566013
Volume Number	11
Issue Number	2
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2016-01-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Keyboards Security Markov processes Probabilistic logic Dictionaries Training Internet Markov Model Authentication Password Password PatternsChinese Users PCFG Markov model password chinese users password patterns
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Safety, Risk, Reliability and Quality

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Next Gen PCFG Password Cracking

User Study, Analysis, and Usable Security of Passwords Based on Digital Objects

Cracking More Password Hashes With Patterns

LPG–PCFG: An Improved Probabilistic Context- Free Grammar to Hit Low-Probability Passwords

When the Password Doesn't Work: Secondary Authentication for Websites

Password-Based Authentication: Preventing Dictionary Attacks

Secure modular password authentication for the web using channel bindings

Captcha as Graphical Passwords—A New Security Primitive Based on Hard AI Problems

Secure Internet banking authentication

Regional Patterns and Vulnerability Analysis of Chinese Web Passwords

Similar Documents

Next Gen PCFG Password Cracking

User Study, Analysis, and Usable Security of Passwords Based on Digital Objects

Cracking More Password Hashes With Patterns

LPG–PCFG: An Improved Probabilistic Context- Free Grammar to Hit Low-Probability Passwords

When the Password Doesn't Work: Secondary Authentication for Websites

Password-Based Authentication: Preventing Dictionary Attacks

Secure modular password authentication for the web using channel bindings

Captcha as Graphical Passwords—A New Security Primitive Based on Hard AI Problems

Secure Internet banking authentication

Regional Patterns and Vulnerability Analysis of Chinese Web Passwords