我可能会被Pwned：第二代被破坏的凭据检查服务
Might I Get Pwned: A Second Generation Compromised Credential Checking Service
摘要：
凭据填充攻击使用被盗密码登录受害者帐户。为了抵御这些攻击，最近部署的受危害的凭据检查（C3）服务提供了API，帮助用户和公司检查用户名、密码对是否暴露。然而，这些服务只检查确切的密码是否泄露，因此不能减轻凭证调整攻击-试图用用户泄露的密码的变体来危害用户帐户。最近的工作表明，即使在采取了凭证填充对策的情况下，凭证调整攻击也可以相当有效地危害帐户。我们启动了C3服务的工作，以保护用户免受凭据调整攻击。核心的潜在挑战是如何识别与其泄露的密码相似的密码，同时保护诚实客户的隐私，并防止恶意客户从服务中提取违规数据。我们正式的问题，并探讨如何衡量密码的相似性，平衡功效，性能和安全性。在此基础上，我们设计了一种新的入侵警报服务“我可能会被Pwned”（MIGP）。我们的模拟表明，MIGP将最先进的1000猜测凭证调整攻击的效率降低了94%。MIGP保护用户隐私，并限制敏感违规条目的潜在暴露。我们表明，该协议是快速的，响应时间接近现有的C3服务。我们与Cloudflare合作，在实践中部署MIGP。
英文摘要：
Credential stuffing attacks use stolen passwords to log into victim accounts. To defend against these attacks, recently deployed compromised credential checking (C3) services provide APIs that help users and companies check whether a username, password pair is exposed. These services however only check if the exact password is leaked, and therefore do not mitigate credential tweaking attacks - attempts to compromise a user account with variants of a user's leaked passwords. Recent work has shown credential tweaking attacks can compromise accounts quite effectively even when the credential stuffing countermeasures are in place. We initiate work on C3 services that protect users from credential tweaking attacks. The core underlying challenge is how to identify passwords that are similar to their leaked passwords while preserving honest clients' privacy and also preventing malicious clients from extracting breach data from the service. We formalize the problem and explore ways to measure password similarity that balance efficacy, performance, and security. Based on this study, we design "Might I Get Pwned" (MIGP), a new kind of breach alerting service. Our simulations show that MIGP reduces the efficacy of state-of-the-art 1000-guess credential tweaking attacks by 94%. MIGP preserves user privacy and limits potential exposure of sensitive breach entries. We show that the protocol is fast, with response time close to existing C3 services. We worked with Cloudflare to deploy MIGP in practice.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
