QQ客服 官方微博 反馈留言

	The Emperor's New Password Creation Policies: An Evaluation of Leading Web Services and the Effect of Role in Resisting Against Online Guessing
	Wang, Ding ; Wang, Ping
	2015
关键词	User authentication Password creation policy Password cracking Online trawling guessing Online targeted guessing SECURITY WEBSITES
英文摘要	While much has changed in Internet security over the past decades, textual passwords remain as the dominant method to secure user web accounts and they are proliferating in nearly every new web services. Nearly every web services, no matter new or aged, now enforce some form of password creation policy. In this work, we conduct an extensive empirical study of 50 password creation policies that are currently imposed on high-profile web services, including 20 policies mainly from US and 30 ones from mainland China. We observe that no two sites enforce the same password creation policy, there is little rationale under their choices of policies when changing policies, and Chinese sites generally enforce more lenient policies than their English counterparts. We proceed to investigate the effectiveness of these 50 policies in resisting against the primary threat to password accounts (i.e. online guessing) by testing each policy against two types of weak passwords which represent two types of online guessing. Our results show that among the total 800 test instances, 541 ones are accepted: 218 ones come from trawling online guessing attempts and 323 ones come from targeted online guessing attempts. This implies that, currently, the policies enforced in leading sites largely fail to serve their purposes, especially vulnerable to targeted online guessing attacks.; EI; CPCI-S(ISTP); wangdingg@pku.edu.cn; pwang@pku.edu.cn; 456-477; 9327
语种	英语
出处	COMPUTER SECURITY - ESORICS 2015, PT II
DOI标识	10.1007/978-3-319-24177-7_23
内容类型	其他
源URL	[http://ir.pku.edu.cn/handle/20.500.11897/436949]
专题	信息科学技术学院 软件与微电子学院
推荐引用方式 GB/T 7714	Wang, Ding,Wang, Ping. The Emperor's New Password Creation Policies: An Evaluation of Leading Web Services and the Effect of Role in Resisting Against Online Guessing. 2015-01-01.

个性服务

查看访问统计

相关权益政策

暂无数据

收藏/分享

除非特别说明，本系统中所有内容都受版权保护，并保留所有权利。