Honeywords: making password-cracking detectable
By Ari Juels, R. Rivest. Conference on Computer and Communications Security, 2013
350 citations recorded by the source corpus.
We propose a simple method for improving the security of hashed passwords: the maintenance of additional ``honeywords'' (false passwords) associated with each user's account. An adversary who steals a file of hashed passwords and inverts the hash function cannot tell if he has found the password or a honeyword. The attempted use of a honeyword for login sets off an alarm. An auxiliary server (the ``honeychecker'') can distinguish the user password from honeywords for the login routine, and will set off an alarm if a honeyword is submitted.
Subfields: Information Systems, Signal Processing
View Paper: https://www.semanticscholar.org/paper/f7b4e7efc89e2743a603a0367cb520f9d6f43e41
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Information Systems
In Signal Processing
Citations in the corpus
- Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound (2018, background): “This can be effectively prevented by our introduction of “honeywords” [34] (i.”
- Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks (2015, background): “Decoy resources have also been recently used to improve the security of hashed pass-words [20] and to detect illegally obtained data from file hosting services [28].”
- A Security Analysis of Honeywords (2018, neutral): “victim user Ui, and exemplifies two sets of 19(=k-1) honeywords generated for Ui’s password “tiger81” by two different methods in [19]: tweaking-tail and hybrid (see Sec.”