A large-scale empirical analysis of Chinese web passwords

Proceedings of the 23rd USENIX Security Symposium

Volumn , Issue , 2014, Pages 559-574

  Li, Zhigong ^a   Han, Weili ^a   Xu, Wenyuan ^b  

^a FUDAN UNIVERSITY   (China)

^b ZHEJIANG UNIVERSITY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

CONTEXT FREE GRAMMARS;

CHINESE WEB; COMPOSITION RULE; EMPIRICAL ANALYSIS; EMPIRICAL STUDIES; ENGLISH WORD; PASSWORD GUESSING; PROBABILISTIC CONTEXT FREE GRAMMARS; REGIONAL DIFFERENCES;

AUTHENTICATION;

EID: 84978533801     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (38)

1. The concise oxford dictionray of current english. http://archive.org/stream/conciseoxforddic00fowlrich/conciseoxforddic00fowlrich_djvu.txt.
2. Wordlist from john the ripper. http://download.openwall.net/pub/passwords/wordlists/.
3. Wordlist from outpost9. http://www.outpost9.com/files/WordLists.html.
4. 178.COM. http://www.178.com/s/information/about.html.
5. 7K7K. http://www.7k7k.com/html/about.htm.
6. BONNEAU, J. The science of guessing: Analyzing an anonymized corpus of 70 million passwords. In Proceedings of 2012 IEEE Symposium on Security and Privacy (SP) (2012), pp. 538-552.
7. BONNEAU, J., HERLEY, C., VAN OORSCHOT, P. C., AND STAJANO, F. The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. In Proceedings of 2012 IEEE Symposium on Security and Privacy (SP) (2012), IEEE, pp. 553-567.
8. BONNEAU, J., PREIBUSCH, S., and ANDERSON, R. A birthday present every eleven wallets? the security of customer-chosen banking pins. In Proceedings of the 16th International Conference on Financial Cryptography (FC '12) (2012).
9. BONNEAU, J., and XU, R. "of contraseñas, sysmawt, and mímǎ: Character encoding issues for web passwords". In Web 2.0 Security & Privacy (May 2012).
10. BOZTAS, S. Entropies, guessing, and cryptography. Tech. rep., Department of Mathematics, Royal Melbourne Institute of Technology, 1999.
11. BURR, W. E., and DODSON., D. F., NEWTON, E. M., PERLNER, R. A., and POLK., W. T., GUPTA, S., and NABBUS, E. A. Nist special publication 800-63-1 electronic authentication guideline, 2006.
12. CNNIC. The 33rd survey report on chinese internet development. http://www.cnnic.cn/hlwfzyj/hlwxzbg/hlwtjbg/201401/t20140116_43820.htm, Jan 2014.
13. CSDN. http://www.csdn.net/company/about.html.
14. DAS, A., BONNEAU, J., CAESAR, M., BORISOV, N., and WANG, X. The tangled web of password reuse. In Proceedings of NDSS 2014 (2014).
15. DE CARN DE CARNAVALET, X., AND MANNAN, M. From very weak to very strong: Analyzing password-strength meters. In Proceedings of NDSS 2014 (2014).
16. DELL'AMICO, M., MICHIARDI, P., and ROUDIER, Y. Password strength: An empirical analysis. In Proceedings IEEE IN-FOCOM 2010 (2010), IEEE, pp. 1-9.
17. DUDUNIU. http://baike.baidu.com/view/1557125.htm.
18. FLORENCIO, D., and HERLEY, C. A large-scale study of web password habits. In Proceedings of the 16th international conference on World Wide Web (WWW'07) (2007), pp. 657-666.
19. HERLEY, C., and VAN OORSCHOT, P. A research agenda acknowledging the persistence of passwords. IEEE Security & Privacy 10, 1 (2012), 28-36.
20. HOWE, A., RAY, I., ROBERTS, M., URBANSKA, M., and BYRNE, Z. The psychology of security for the home computer user. In Proceedings of 2012 IEEE Symposium on Security and Privacy (SP) (2012), pp. 209-223.
21. KELLEY, P., KOMANDURI, S., MAZUREK, M., SHAY, R., VIDAS, T., BAUER, L., CHRISTIN, N., CRANOR, L., and LOPEZ, J. Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. In Proceedings of 2012 IEEE Symposium on Security and Privacy (SP) (2012), pp. 523-537.
22. KUO, C., ROMANOSKY, S., and CRANOR, L. F. Human selection of mnemonic phrase-based passwords. In Proceedings of the Second Symposium on Usable privacy and security (2006), ACM, pp. 67-78.
23. MALONE, D., and MAHER, K. Investigating the distribution of password choices. In Proceedings of the 21st International Conference on World Wide Web (2012), ACM, pp. 301-310.
24. MAZUREK, M. L., KOMANDURI, S., VIDAS, T., BAUER, L., CHRISTIN, N., CRANOR, L. F., and KELLEY., P. G., SHAY, R., and UR, B. Measuring password guessability for an entire university. In Proceedings of the 2013 ACM Conference on Computer and Communications Security (2013), ACM, pp. 173-186.
25. MORRIS, R., and THOMPSON, K. Password security: A case history. Communications of the ACM 22, 11 (1979), 594-597.
26. NARAYANAN, A., and SHMATIKOV, V. Fast dictionary attacks on passwords using time-space tradeoff. In Proceedings of the 12th ACM Conference on Computer and Communications Security (2005), ACM, pp. 364-372.
27. PINKAS, B., and SANDER, T. Securing passwords against dictionary attacks. In Proceedings of the 9th ACM Conference on Computer and Communications Security (2002), ACM, pp. 161-170.
28. PLIAM, J. O. On the incomparability of entropy and marginal guesswork in brute-force attacks. In INDOCRYPT (2000), pp. 67-79.
29. R. VERAS, C. COLLINS, J. T. On the semantic patterns of passwords and their security impact. In Proceedings of NDSS 2014 (2014).
30. ROCKYOU. http://rockyou.com/ry/about-us.
31. SAWYER, D. A. The characteristics of user-generated passwords. Tech. rep., DTIC Document, 1990.
32. SCHWEITZER, D., BOLENG, J., HUGHES, C., and MURPHY, L. Visualizing keyboard pattern passwords. In Proceedings of 6th International Workshop on Visualization for Cyber Security (VizSec 2009) (2009), IEEE, pp. 69-73.
33. TIANYA. http://help.tianya.cn/about/history/2011/06/02/166666.shtml.
34. VERAS, R., COLLINS, C., and THORPE, J. On the semantic patterns of passwords and their security impact. In Proceedings of NDSS 2014 (2014).
35. WEIR, M., AGGARWAL, S., DE MEDEIROS, B., and GLODEK, B. Password cracking using probabilistic context-free grammars. In Proceedings of the 30th IEEE Symposium on Security and Privacy (2009), IEEE, pp. 391-405.
36. XIANG, G., and HONG, J. I. A hybrid phish detection approach by identity discovery and keywords retrieval. In Proceedings of the 18th Internation Conference on World Wide Web (WWW'09) (2009), pp. 561-570.
37. YAHOO. http://info.yahoo.com/.
38. YAN, J., BLACKWELL, A., ANDERSON, R., and GRANT, A. Password memorability and security: empirical results. IEEE Security Privacy 2, 5 (2004), 25-31.