Securing passwords against dictionary attacks

By Benny Pinkas, Tomas Sander. Conference on Computer and Communications Security, 2002

426 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/a7760f4416cea2d3fe16ef8883d537032f760b9d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

1. Joseph Bonneau
2. Matteo Dell'Amico
3. Pietro Michiardi
4. Yves Roudier
5. Xiuzhen Cheng
6. J. Langford
7. Robert Biddle
8. Romit Roy Choudhury

In Information Systems

1. Joseph Bonneau
2. Pietro Michiardi
3. Matteo Dell'Amico
4. Yves Roudier
5. Manuel Blum
6. J. Langford
7. Robert Biddle
8. Romit Roy Choudhury

In Signal Processing

1. Joseph Bonneau
2. Matteo Dell'Amico
3. Pietro Michiardi
4. Yves Roudier
5. J. Langford
6. Robert Biddle
7. Romit Roy Choudhury
8. Vitaly Shmatikov

Citations in the corpus

• CAPTCHA: Using Hard AI Problems for Security (2003, background): “Pinkas and Sander [11] have suggested using captchas to prevent dictionary attacks in password systems.”
• Password Strength: An Empirical Analysis (2010, background): “This response, however, opens the door to denial of service attacks on user accounts and is ineffective against attacks not targeted towards a single user [14].”
• Tapprints: your finger taps have fingerprints (2012, background): “phisticated spell-checking [23], an attacker may be able to recognize words with higher accuracy.”
• Graphical Password Authentication Using Cued Click Points (2007, background): “General attacks against such a system, where attackers try to break into any account [11], are slowed due to the precautions mentioned above.”
• Graphical passwords: Learning from the first twelve years (2012, methodology): “For graphical as well as text passwords, defenses may be aided by clever use of CAPTCHAs [Pinkas and Sander 2002], increas­ingly delaying (e.g., doubling) system response time on successive incorrect guesses, or by limiting, per user account, the number of incorrect login attempts allowed before…”
• Edge Computing Security: State of the Art and Challenges (2019, background): “Pinkas and Sander proposed the first two-factor authentication technique by adding a challenge that can be easily answered by human beings but infeasible to be answered by automated programs from dictionary attacks [157].”
• Guessing human-chosen secrets (2012, background): “Pinkas and Sander instead suggest deploying CAPTCHAs to slow guessing attacks [235].”
• Fast dictionary attacks on passwords using time-space tradeoff (2005, methodology): “Possible techniques include graphical passwords [18, 36, 8], reverse Turing tests [31, 35], and hardening passwords with biometric information [26].”