TL;DR
This paper introduces Bernoulli honeywords, a probabilistic approach to generating decoy passwords that improves security and detection capabilities in honeyword systems by enabling analytical assessment of breach detection probabilities.
Contribution
It proposes a novel Bernoulli process-based method for honeyword generation, integrating it into existing systems and enabling precise analysis of breach detection performance.
Findings
Analytic derivation of false breach-detection probabilities
Enhanced security and detection efficacy of honeyword systems
Potential performance improvements in honeyword deployment
Abstract
Decoy passwords, or "honeywords," planted in a credential database can alert a site to its breach if ever submitted in a login attempt. To be effective, some honeywords must appear at least as likely to be user-chosen passwords as the real ones, and honeywords must be very difficult to guess without having breached the database, to prevent false breach alarms. These goals have proved elusive, however, for heuristic honeyword generation algorithms. In this paper we explore an alternative strategy in which the defender treats honeyword selection as a Bernoulli process in which each possible password (except the user-chosen one) is selected as a honeyword independently with some fixed probability. We show how Bernoulli honeywords can be integrated into two existing system designs for leveraging honeywords: one based on a honeychecker that stores the secret index of the user-chosen password…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
