arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2309.03384cs.CR
收藏

大规模测量网站密码创建策略

Measuring Website Password Creation Policies At Scale

Suood Alroomi, Frank Li

备注：
This is an extended version of a conference publication (Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS 23)) that includes several appendices, which were omitted due to space constraints
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文开发了一种自动推断网站密码创建策略的技术，并大规模测量了超过20K个网站的策略，首次为理解网络密码策略现状及改进认证提供了大规模实证依据。

摘要：

研究人员已深入探讨了密码创建策略如何影响用户自选密码的安全性与可用性，并制定了基于证据的策略指南。然而，为了让网络认证在实践中得到改进，网站必须切实实施这些建议。迄今为止，对于网站实际部署了何种密码创建策略，相关调查十分有限。现有研究大多已过时，且所有研究均依赖人工评估，仅考察少量网站（最多150个，且偏向头部网站）。因此，我们对当今使用的密码策略缺乏广泛了解。本文开发了一种自动推断网站密码创建策略的技术，并大规模应用该技术测量了超过20K个网站，比先前研究多出两个数量级（135倍）。我们的发现指出了已部署的常见策略、弱策略的潜在原因，以及在实践中改进认证的方向。最终，本研究首次提供了对网络上密码创建策略的大规模理解。

英文摘要：

Researchers have extensively explored how password creation policies influence the security and usability of user-chosen passwords, producing evidence-based policy guidelines. However, for web authentication to improve in practice, websites must actually implement these recommendations. To date, there has been limited investigation into what password creation policies are actually deployed by sites. Existing works are mostly dated and all studies relied on manual evaluations, assessing a small set of sites (at most 150, skewed towards top sites). Thus, we lack a broad understanding of the password policies used today. In this paper, we develop an automated technique for inferring a website's password creation policy, and apply it at scale to measure the policies of over 20K sites, over two orders of magnitude (135x) more sites than prior work. Our findings identify the common policies deployed, potential causes of weak policies, and directions for improving authentication in practice. Ultimately, our study provides the first large-scale understanding of password creation policies on the web.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑