The Experts below are selected from a list of 93 Experts worldwide ranked by ideXlab platform
Richard Shay - One of the best experts on this subject based on the ideXlab platform.
-
Measuring Password Guessability for an Entire University (CMU-CyLab-13-013)
2018Co-Authors: Michelle L. Mazurek, Saranga Komanduri, Nicolas Christin, Tim Vidas, Ljudevit Bauer, Lorrie Cranor, Patrick Kelley, Richard ShayAbstract:Despite considerable research on Passwords, empirical studies of Password strength have been limited by lack of access to plaintext Passwords, small data sets, and Password sets specifically collected for a research study or from low-value accounts. Properties of Passwords used for high-value accounts thus remain poorly understood. We fill this gap by studying the single-sign-on Passwords used by over 25,000 faculty, staff, and students at a research university with a Complex Password policy. Key aspects of our contributions rest on our (indirect) access to plaintext Passwords. We describe our data collection methodology, particularly the many precautions we took to minimize risks to users. We then analyze how guessable the collected Passwords would be during an offline attack by subjecting them to a state-of-the-art Password cracking algorithm. We discover significant correlations between a number of demographic and behavioral factors and Password strength. For example, we find that users associated with the computer science school make Passwords more than 1.8 times as strong as those of users associated with the business school. In addition, we find that stronger Passwords are correlated with a higher rate of errors entering them. We also compare the guessability and other characteristics of the Passwords we analyzed to sets previously collected in controlled experiments or leaked from low-value accounts. We find more consistent similarities between the university Passwords and Passwords collected for research studies under similar composition policies than we do between the university Passwords and subsets of Passwords leaked from low-value accounts that happen to comply with the same policies.
-
Measuring Password Guessability for an Entire University (CMU-CyLab-13-013)
2013Co-Authors: Michelle L. Mazurek, Saranga Komanduri, Patrick Gage Kelley, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Tim Vidas, Richard ShayAbstract:Despite considerable research on Passwords, empirical studies of Password strength have been limited by lack of access to plaintext Passwords, small data sets, and Password sets specifically collected for a research study or from low-value accounts. Properties of Passwords used for high-value accounts thus remain poorly understood. We fill this gap by studying the single-sign-on Passwords used by over 25,000 faculty, staff, and students at a research university with a Complex Password policy. Key aspects of our contributions rest on our (indirect) access to plaintext Passwords. We describe our data collection methodology, particularly the many precautions we took to minimize risks to users. We then analyze how guessable the collected Passwords would be during an offline attack by subjecting them to a state-of-the-art Password cracking algorithm. We discover significant correlations between a number of demographic and behavioral factors and Password strength. For example, we find that users associated with the computer science school make Passwords more than 1.8 times as strong as those of users associated with the business school. In addition, we find that stronger Passwords are correlated with a higher rate of errors entering them. We also compare the guessability and other characteristics of the Passwords we analyzed to sets previously collected in controlled experiments or leaked from low-value accounts. We find more consistent similarities between the university Passwords and Passwords collected for research studies under similar composition policies than we do between the university Passwords and subsets of Passwords leaked from low-value accounts that happen to comply with
-
ACM Conference on Computer and Communications Security - Measuring Password guessability for an entire university
Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13, 2013Co-Authors: Michelle L. Mazurek, Saranga Komanduri, Patrick Gage Kelley, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Tim Vidas, Richard ShayAbstract:Despite considerable research on Passwords, empirical studies of Password strength have been limited by lack of access to plaintext Passwords, small data sets, and Password sets specifically collected for a research study or from low-value accounts. Properties of Passwords used for high-value accounts thus remain poorly understood. We fill this gap by studying the single-sign-on Passwords used by over 25,000 faculty, staff, and students at a research university with a Complex Password policy. Key aspects of our contributions rest on our (indirect) access to plaintext Passwords. We describe our data collection methodology, particularly the many precautions we took to minimize risks to users. We then analyze how guessable the collected Passwords would be during an offline attack by subjecting them to a state-of-the-art Password cracking algorithm. We discover significant correlations between a number of demographic and behavioral factors and Password strength. For example, we find that users associated with the computer science school make Passwords more than 1.5 times as strong as those of users associated with the business school. while users associated with computer science make strong ones. In addition, we find that stronger Passwords are correlated with a higher rate of errors entering them. We also compare the guessability and other characteristics of the Passwords we analyzed to sets previously collected in controlled experiments or leaked from low-value accounts. We find more consistent similarities between the university Passwords and Passwords collected for research studies under similar composition policies than we do between the university Passwords and subsets of Passwords leaked from low-value accounts that happen to comply with the same policies.
-
SOUPS - Encountering stronger Password requirements: user attitudes and behaviors
Proceedings of the Sixth Symposium on Usable Privacy and Security - SOUPS '10, 2010Co-Authors: Richard Shay, Saranga Komanduri, Patrick Gage Kelley, Pedro Giovanni Leon, Michelle L. Mazurek, Lujo Bauer, Nicolas Christin, Lorrie Faith CranorAbstract:Text-based Passwords are still the most commonly used authentication mechanism in information systems. We took advantage of a unique opportunity presented by a significant change in the Carnegie Mellon University (CMU) computing services Password policy that required users to change their Passwords. Through our survey of 470 CMU computer users, we collected data about behaviors and practices related to the use and creation of Passwords. We also captured users' opinions about the new, stronger policy requirements. Our analysis shows that, although most of the users were annoyed by the need to create a Complex Password, they believe that they are now more secure. Furthermore, we perform an entropy analysis and discuss how our findings relate to NIST recommendations for creating a Password policy. We also examine how users answer specific questions related to their Passwords. Our results can be helpful in designing better Password policies that consider not only technical aspects of specific policy rules, but also users' behavior in response to those rules.
Robin Doss - One of the best experts on this subject based on the ideXlab platform.
-
FNSS - Attainable Hacks on Keystore Files in Ethereum Wallets—A Systematic Analysis
Communications in Computer and Information Science, 2019Co-Authors: Purathani Praitheeshan, Yi Wei Xin, Lei Pan, Robin DossAbstract:Ethereum is a popular Blockchain platform that allows users to manage their cryptocurrency transactions through the wallets. Ethereum wallet helps interact with the blockchain network easily, and it keeps Ethereum cryptocurrency (Ether) transaction data of its users. The use of Ethereum and wallets grows rapidly. Since they handle huge value of crypto assets, attackers are keen to hack and steal Ethers from Ethereum wallets. But there lacks comprehensive security analysis, especially on keystore files in Ethereum wallets. There were a few incidents occurred with huge loss of Ethers in Etheruem wallets within the last five years. In this paper, we conducted a systematic analysis on hacking methods from the existing literature and conducted experiments to find how the Ethereum wallet’s keystore file is vulnerable to the adversaries. Since the keystore file is secured with a Password, we have used the brute-force and the dictionary attack to crack the Password of the keystore file in Ethereum wallets. Our results showed that the dictionary attack is more efficient to hack the keystore file than the brute-force attack. Further, the keystore file is less vulnerable, if it is used Complex Password credentials.
-
Attainable Hacks on Keystore Files in Ethereum Wallets—A Systematic Analysis
Future Network Systems and Security, 2019Co-Authors: Purathani Praitheeshan, Yi Wei Xin, Lei Pan, Robin DossAbstract:Ethereum is a popular Blockchain platform that allows users to manage their cryptocurrency transactions through the wallets. Ethereum wallet helps interact with the blockchain network easily, and it keeps Ethereum cryptocurrency (Ether) transaction data of its users. The use of Ethereum and wallets grows rapidly. Since they handle huge value of crypto assets, attackers are keen to hack and steal Ethers from Ethereum wallets. But there lacks comprehensive security analysis, especially on keystore files in Ethereum wallets. There were a few incidents occurred with huge loss of Ethers in Etheruem wallets within the last five years. In this paper, we conducted a systematic analysis on hacking methods from the existing literature and conducted experiments to find how the Ethereum wallet’s keystore file is vulnerable to the adversaries. Since the keystore file is secured with a Password, we have used the brute-force and the dictionary attack to crack the Password of the keystore file in Ethereum wallets. Our results showed that the dictionary attack is more efficient to hack the keystore file than the brute-force attack. Further, the keystore file is less vulnerable, if it is used Complex Password credentials.
Sura Jasim Mohammed - One of the best experts on this subject based on the ideXlab platform.
-
A New Algorithm of Automatic Complex Password Generator Employing Genetic Algorithm
JOURNAL OF UNIVERSITY OF BABYLON for Pure and Applied Sciences, 2018Co-Authors: Sura Jasim MohammedAbstract:نتيجة للتزايد الحاصل بمشاركة المعلومات, عمومية الانترنت, معاملات التجارة الإلكترونية, وتناقل البيانات, لذا اصبحت الامنية والموثوقية موضوع مهم وضروري. في هذا البحث تم اقتراح خطة الية لتوليد كلمة سر قوية ومعقدة بالاعتماد على ادخال بيانات اولية مثلا نص (معلومات ذات معنى وبسيطة او لا), مع مفهوم تشفيرها, ثم توظيف الخوارزمية الجينية وذلك باستخدام عملياتها الارتباط والطفرة لتوليد بيانات مختلفة عن الاخرى المدخلة. ان كلمة السر المتولدة لا يمكن تخمينها وممكن استخدامها بعدة ومختلف الخدمات وتطبيقات الانترنت مثل الشبكات الاجتماعية, الانظمة المؤمنة, الانظمة الموزعة, وخدمات عبر الانترنت. ان مولد كلمة السر المقترح يحقق الانتشار، العشوائية، والارتباك, والذين هم ضروريين ومطلوبين ومستهدفين بكلمة السر الناتجة, اضافة الى ملاحظة ان كلمة السر المتولدة يختلف عن طول البيانات الاولية, واي تغيير وتحديث بسيط في البيانات الاولية ينتج تحديث كبير وواضح بكلمة السر المتولدة. انجز العمل المقترح باستخدام لغة البرمجة فيجوال بيسك.
-
New Algorithm of Automatic Complex Password Generator Employing Genetic Algorithm
University of Babylon, 2018Co-Authors: Sura Jasim MohammedAbstract:Due to the occurred increasing in information sharing, internet popularization, E-commerce transactions, and data transferring, security and authenticity become an important and necessary subject. In this paper an automated schema was proposed to generate a strong and Complex Password which is based on entering initial data such as text (meaningful and simple information or not), with the concept of encoding it, then employing the Genetic Algorithm by using its operations crossover and mutation to generated different data from the entered one. The generated Password is non-guessable and can be used in many and different applications and internet services like social networks, secured system, distributed systems, and online services. The proposed Password generator achieved diffusion, randomness, and confusions, which are very necessary, required and targeted in the resulted Password, in addition to the notice that the length of the generated Password differs from the length of initial data, and any simple changing and modification in the initial data produces more and clear modification in the generated Password. The proposed work was done using visual basic programing language
Michelle L. Mazurek - One of the best experts on this subject based on the ideXlab platform.
-
Measuring Password Guessability for an Entire University (CMU-CyLab-13-013)
2018Co-Authors: Michelle L. Mazurek, Saranga Komanduri, Nicolas Christin, Tim Vidas, Ljudevit Bauer, Lorrie Cranor, Patrick Kelley, Richard ShayAbstract:Despite considerable research on Passwords, empirical studies of Password strength have been limited by lack of access to plaintext Passwords, small data sets, and Password sets specifically collected for a research study or from low-value accounts. Properties of Passwords used for high-value accounts thus remain poorly understood. We fill this gap by studying the single-sign-on Passwords used by over 25,000 faculty, staff, and students at a research university with a Complex Password policy. Key aspects of our contributions rest on our (indirect) access to plaintext Passwords. We describe our data collection methodology, particularly the many precautions we took to minimize risks to users. We then analyze how guessable the collected Passwords would be during an offline attack by subjecting them to a state-of-the-art Password cracking algorithm. We discover significant correlations between a number of demographic and behavioral factors and Password strength. For example, we find that users associated with the computer science school make Passwords more than 1.8 times as strong as those of users associated with the business school. In addition, we find that stronger Passwords are correlated with a higher rate of errors entering them. We also compare the guessability and other characteristics of the Passwords we analyzed to sets previously collected in controlled experiments or leaked from low-value accounts. We find more consistent similarities between the university Passwords and Passwords collected for research studies under similar composition policies than we do between the university Passwords and subsets of Passwords leaked from low-value accounts that happen to comply with the same policies.
-
Measuring Password Guessability for an Entire University (CMU-CyLab-13-013)
2013Co-Authors: Michelle L. Mazurek, Saranga Komanduri, Patrick Gage Kelley, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Tim Vidas, Richard ShayAbstract:Despite considerable research on Passwords, empirical studies of Password strength have been limited by lack of access to plaintext Passwords, small data sets, and Password sets specifically collected for a research study or from low-value accounts. Properties of Passwords used for high-value accounts thus remain poorly understood. We fill this gap by studying the single-sign-on Passwords used by over 25,000 faculty, staff, and students at a research university with a Complex Password policy. Key aspects of our contributions rest on our (indirect) access to plaintext Passwords. We describe our data collection methodology, particularly the many precautions we took to minimize risks to users. We then analyze how guessable the collected Passwords would be during an offline attack by subjecting them to a state-of-the-art Password cracking algorithm. We discover significant correlations between a number of demographic and behavioral factors and Password strength. For example, we find that users associated with the computer science school make Passwords more than 1.8 times as strong as those of users associated with the business school. In addition, we find that stronger Passwords are correlated with a higher rate of errors entering them. We also compare the guessability and other characteristics of the Passwords we analyzed to sets previously collected in controlled experiments or leaked from low-value accounts. We find more consistent similarities between the university Passwords and Passwords collected for research studies under similar composition policies than we do between the university Passwords and subsets of Passwords leaked from low-value accounts that happen to comply with
-
ACM Conference on Computer and Communications Security - Measuring Password guessability for an entire university
Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13, 2013Co-Authors: Michelle L. Mazurek, Saranga Komanduri, Patrick Gage Kelley, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Tim Vidas, Richard ShayAbstract:Despite considerable research on Passwords, empirical studies of Password strength have been limited by lack of access to plaintext Passwords, small data sets, and Password sets specifically collected for a research study or from low-value accounts. Properties of Passwords used for high-value accounts thus remain poorly understood. We fill this gap by studying the single-sign-on Passwords used by over 25,000 faculty, staff, and students at a research university with a Complex Password policy. Key aspects of our contributions rest on our (indirect) access to plaintext Passwords. We describe our data collection methodology, particularly the many precautions we took to minimize risks to users. We then analyze how guessable the collected Passwords would be during an offline attack by subjecting them to a state-of-the-art Password cracking algorithm. We discover significant correlations between a number of demographic and behavioral factors and Password strength. For example, we find that users associated with the computer science school make Passwords more than 1.5 times as strong as those of users associated with the business school. while users associated with computer science make strong ones. In addition, we find that stronger Passwords are correlated with a higher rate of errors entering them. We also compare the guessability and other characteristics of the Passwords we analyzed to sets previously collected in controlled experiments or leaked from low-value accounts. We find more consistent similarities between the university Passwords and Passwords collected for research studies under similar composition policies than we do between the university Passwords and subsets of Passwords leaked from low-value accounts that happen to comply with the same policies.
-
SOUPS - Encountering stronger Password requirements: user attitudes and behaviors
Proceedings of the Sixth Symposium on Usable Privacy and Security - SOUPS '10, 2010Co-Authors: Richard Shay, Saranga Komanduri, Patrick Gage Kelley, Pedro Giovanni Leon, Michelle L. Mazurek, Lujo Bauer, Nicolas Christin, Lorrie Faith CranorAbstract:Text-based Passwords are still the most commonly used authentication mechanism in information systems. We took advantage of a unique opportunity presented by a significant change in the Carnegie Mellon University (CMU) computing services Password policy that required users to change their Passwords. Through our survey of 470 CMU computer users, we collected data about behaviors and practices related to the use and creation of Passwords. We also captured users' opinions about the new, stronger policy requirements. Our analysis shows that, although most of the users were annoyed by the need to create a Complex Password, they believe that they are now more secure. Furthermore, we perform an entropy analysis and discuss how our findings relate to NIST recommendations for creating a Password policy. We also examine how users answer specific questions related to their Passwords. Our results can be helpful in designing better Password policies that consider not only technical aspects of specific policy rules, but also users' behavior in response to those rules.
Purathani Praitheeshan - One of the best experts on this subject based on the ideXlab platform.
-
FNSS - Attainable Hacks on Keystore Files in Ethereum Wallets—A Systematic Analysis
Communications in Computer and Information Science, 2019Co-Authors: Purathani Praitheeshan, Yi Wei Xin, Lei Pan, Robin DossAbstract:Ethereum is a popular Blockchain platform that allows users to manage their cryptocurrency transactions through the wallets. Ethereum wallet helps interact with the blockchain network easily, and it keeps Ethereum cryptocurrency (Ether) transaction data of its users. The use of Ethereum and wallets grows rapidly. Since they handle huge value of crypto assets, attackers are keen to hack and steal Ethers from Ethereum wallets. But there lacks comprehensive security analysis, especially on keystore files in Ethereum wallets. There were a few incidents occurred with huge loss of Ethers in Etheruem wallets within the last five years. In this paper, we conducted a systematic analysis on hacking methods from the existing literature and conducted experiments to find how the Ethereum wallet’s keystore file is vulnerable to the adversaries. Since the keystore file is secured with a Password, we have used the brute-force and the dictionary attack to crack the Password of the keystore file in Ethereum wallets. Our results showed that the dictionary attack is more efficient to hack the keystore file than the brute-force attack. Further, the keystore file is less vulnerable, if it is used Complex Password credentials.
-
Attainable Hacks on Keystore Files in Ethereum Wallets—A Systematic Analysis
Future Network Systems and Security, 2019Co-Authors: Purathani Praitheeshan, Yi Wei Xin, Lei Pan, Robin DossAbstract:Ethereum is a popular Blockchain platform that allows users to manage their cryptocurrency transactions through the wallets. Ethereum wallet helps interact with the blockchain network easily, and it keeps Ethereum cryptocurrency (Ether) transaction data of its users. The use of Ethereum and wallets grows rapidly. Since they handle huge value of crypto assets, attackers are keen to hack and steal Ethers from Ethereum wallets. But there lacks comprehensive security analysis, especially on keystore files in Ethereum wallets. There were a few incidents occurred with huge loss of Ethers in Etheruem wallets within the last five years. In this paper, we conducted a systematic analysis on hacking methods from the existing literature and conducted experiments to find how the Ethereum wallet’s keystore file is vulnerable to the adversaries. Since the keystore file is secured with a Password, we have used the brute-force and the dictionary attack to crack the Password of the keystore file in Ethereum wallets. Our results showed that the dictionary attack is more efficient to hack the keystore file than the brute-force attack. Further, the keystore file is less vulnerable, if it is used Complex Password credentials.