Research Article
PII-PSM: A New Targeted Password Strength Meter Using Personally Identifiable Information
@INPROCEEDINGS{10.1007/978-3-031-25538-0_34, author={Qiying Dong and Ding Wang and Yaosheng Shen and Chunfu Jia}, title={PII-PSM: A New Targeted Password Strength Meter Using Personally Identifiable Information}, proceedings={Security and Privacy in Communication Networks. 18th EAI International Conference, SecureComm 2022, Virtual Event, October 2022, Proceedings}, proceedings_a={SECURECOMM}, year={2023}, month={2}, keywords={Password authentication Targeted guessing Password strength meter Personally identifiable information Password probabilistic model}, doi={10.1007/978-3-031-25538-0_34} }- Qiying Dong
Ding Wang
Yaosheng Shen
Chunfu Jia
Year: 2023
PII-PSM: A New Targeted Password Strength Meter Using Personally Identifiable Information
SECURECOMM
Springer
DOI: 10.1007/978-3-031-25538-0_34
Abstract
In recent years, unending breaches of users’ personally identifiable information (PII) have become increasingly severe, making targeted password guessing using PII a practical threat. However, to our knowledge, most password strength meters (PSMs) only consider the traditional trawling password guessing threat, and no PSM has taken into account the more severe targeted guessing threat using PII (e.g., name, birthday, and phone number). To fill this gap, in this paper, we mainly focus on targeted password strength evaluation in the scenario where users’ PII is available to the attacker. First, to capture more fine-grained password structures, we introduce the high-frequency substring as a new grammar tag into leading targeted password probabilistic models TarGuess-I and TarMarkov, and propose TarGuess-I-H and TarMarkov-H. Then, we weight and combine our two improved models to devise PII-PSM,the first practicaltargeted PSM resistant to common PII-accessible attackers. By using the weighted Spearman (WSpearman) metric recommended at CCS’18, we evaluate the accuracy of our PII-PSM and its counterparts (i.e., our TarGuess-I-H and TarMarkov-H, as well as two benchmarks of Optimal and Minauto). We conduct evaluation experiments on password datasets leaked from eight high-profile English and Chinese services. Results show that our PII-PSM is more accurate than TarGuess-I-H and TarMarkov-H, and is closer to Optimal and Minauto, with WSpearman differences of only 0.014(\sim )0.023 and 0.012(\sim )0.031, respectively. This establishes the accuracy of PII-PSM, facilitating to nudge users to select stronger passwords.
