The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
InfoResearchPeer-reviewed
On the Insecurity of Internally Sampled Honeyword Schemes
- Published
- Record updated
Summary
This paper shows that existing internally sampled honeyword schemes, Honeyindex (TDSC'16) and Superword (COSE'21), contain two critical security flaws and two critical usability flaws. Using Bayesian and intersection attack theories against three attacker models, the authors find that with 40 sweetwords per user, a basic attacker identifies 4.31%~5.04% of real passwords in 10^4 honeyword login attempts, above the ideal 2.50% (1/40), and more advanced attackers identify 18.6%~44.8% and 20.6%~43.6%.