Password Security Research Articles

Cyber Hygiene and Cyber Victimization Among Limited English Proficiency (LEP) Internet Users: A Mixed-Method Study

ABSTRACT Information and resources on cybersecurity in non-English languages are non-existent or very limited. There is also a dearth of research on cyber victimization involving samples of limited English proficiency (LEP) individuals. We surveyed a convenience sample of LEP Internet users and examined the effects of demographic characteristics on cyber hygiene practices and cyber hygiene practices on cyber victimization. We also conducted focus groups to explore participants’ knowledge about cyber safety and their perceptions of the availability of cybersecurity information and resources in languages other than English. We found the demographic measures of age, sex, marital status, education level, and employment status to be significantly related to seven cyber hygiene practices (having antivirus software, using strong passwords, not sharing passwords, not using public Wi-Fi, not accepting stranger requests, checking e-mail source, and not downloading unverified files). We also found the cyber hygiene measures predicted eight types of cyber victimization (phishing, computer virus infection, online harassment and scams, and e-mail, social media, shopping, and other accounts hacking). From the focus groups, we uncovered that although the participants exhibited inadequate knowledge concerning the recommended cyber hygiene practices, they appeared to be motivated to adopt them. The policy implications of our study are discussed.

Securing Digital Vaults: Advanced Tactics for Protecting Personal Information Online

Abstract: This research explores the critical significance of robust password security in protecting personal and sensitive data on digital platforms. It emphasizes key factors contributing to password vulnerability, including length, structure, recycling, and irregular updates. The paper stresses the paramount importance of creating strong, unique passwords while avoiding personal details and refraining from password reuse. Additionally, it discusses advanced techniques like the Honeyword technique and HoneyEncryption to enhance password security. User education on mobile authentication and preventing shoulder-surfing attacks is highlighted. Privacy implications related to sensitive personal data usage are also examined. Moreover, the potential benefits of graphical passwords in improving security and user convenience are explored. Ultimately, this paper provides valuable insights and practical recommendations for individuals and organizations to prioritize and strengthen password security, thus safeguarding their personal information online.

BDPM: A secure batch dynamic password management scheme in industrial internet environments

The rapid development of Industrial Internet has promoted the deep integration of Information Technology (IT) and Industrial Control (IC), so that network attacks have gradually invaded IC zone. Password security is the first line of defense to ensure the security of IC devices. In this paper, we propose a secure Batch Dynamic Password Management (BDPM) scheme in Industrial Internet environments. Aiming to automatically configure strong passwords for IC devices, our scheme can achieve a batch password generation algorithm based on SM3 Cryptographic Hash Algorithm, which encrypts the input string and then intercepts and replaces the hash value to ensure the uniqueness and crack resistance of passwords. Moreover, we continuously monitor the status of vulnerable IT devices through a zero trust anomaly monitoring mechanism and introduce a password updating mechanism for relevant IC devices, which is triggered by sending an alarm to IC devices that have interaction rights with the compromised IT device. Subsequently, we construct a resilient blockchain called PS_chain and execute two different password storage schemes based on the threshold of password updates to ensure storage security and reduce the load on block storage. The security analysis shows that our scheme can defend against the threat model and can comprehensively improve the security of IC device passwords. The simulation results show that our scheme can enhance the strength of IC device passwords while securely storing IC device passwords in a low-load manner.

Exploiting multimodal biometrics for enhancing password security

Abstract Digitization of every daily procedure requires trustworthy verification schemes. People tend to overlook the security of the passwords they use, i.e. they use the same password on different occasions, they neglect to change them periodically or they often forget them. This raises a major security issue, especially for elderly people who are not familiar with modern technology and its risks and challenges. To overcome these drawbacks, biometric factors were utilized, and nowadays, they have been widely adopted due to their convenience of use and ease of hardware installation. Many biometric-based authentication schemes were proposed, but despite the advantages that they offer, recent research has shown that biometrics by itself cannot be considered as an inviolable technique. Recently, we have proposed StegoPass, a novel method that obtains the 68 facial points of a user and utilizes them as a stego message to an image. This produced stego image was the password. Although the experiments conducted showed maximum security, it would be challenging to enhance the robustness of the proposed model for even more attacks. This paper examines the utilization of multimodal biometrics as the secret message embedded in the image. More specifically, besides the extraction of the facial points, we extract the unique minutiae moments and combine them in a feature vector. This feature vector is then embedded in the image. Two different datasets were used, and the security of the method was tested against state-of-the-art deep learning models, i.e. generative adversarial networks, to test whether the image could be digitally synthesized and fool the proposed verification scheme. The results proved that the new enhanced version of StegoPass offers an extremely secure method as its predecessor.

BANK OF PASSWORDS: a secure Android password manager implemented based on specific requirements

Passwords serve as a vital means to safeguard our digital accounts. Many individuals resort to conventional methods like writing down passwords on paper or storing them on cloud services, often overlooking security risks, forgetting, and divulging is the most notable, which leads to loss of access to accounts, or potential breaches. In this paper, we propose the development of an Android application named "BANK OF PASSWORD" to address this issue. Our work focuses on creating a lightweight app equipped with essential functionalities desired by users, including password addition, updating, copying, searching, and deletion. To ensure the security of stored passwords, our approach incorporates various protective measures, such as access restriction through a login process and the utilization of SHA256 hashing and AES256 encryption for password encryption, where stored passwords are securely encrypted and stored as ciphertexts within an SQLite database. A fingerprint authentication was implemented as a second login method. Extensive testing of the application demonstrates the successful functioning of all proposed features and requirements on devices running API level 26 or above.

Ethical hacking: real evaluation model of brute force attacks in password cracking

Despite ongoing efforts to convince users of the value of password security and to enforce password creation standards on them, in many information systems the human factor still plays a role. In addition, not only do most users’ password creation and management practices largely remain unchanged, but password cracking tools and more critically, computer hardware also continue to advance. In this paper we present a model in ethical hacking; the proposed model concentrated on brute force attacks for password cracking. The main novelty of our work is that it first presents a mathematical model that calculates the number of different password permutations of varying lengths. Then the brute force attack is modelled using the Markov chain model and a method is developed to formulate the conventional optimization problem, which is classified as a discrete nonlinear problem. The experiments’ results demonstrate and validate the method’s effectiveness and suitability.

Digital Marketing in the Age of Cyber Threats: A Comprehensive Guide to Cybersecurity Practices

As digital marketing strategies become increasingly integrated into business models, unique vulnerabilities to cyber threats make cybersecurity essential. This descriptive study provides a detailed analysis of cybersecurity for digital marketing, which is rapidly evolving with technological advancements and consumer behavior transitions. The integration of tools like Search Engine Optimization, social media, and online advertising and their susceptibility to cyber risks are investigated. Critical cybersecurity threats in digital marketing, including phishing attacks, malware and ransomware, data breaches, and Distributed Denial of Service attacks, are explored, emphasizing their potential impact on business operations, customer trust, and brand reputation. The study further explores best practices in cybersecurity tailored to the digital marketing area, advocating for regular software updates, comprehensive employee training, stringent data encryption protocols, strong password policies, multi-factor authentication, and periodic security audits, highlighting the importance of data backups and adherence to data protection laws in maintaining legal and ethical standards. The role of Artificial Intelligence and Machine Learning is investigated, emphasizing how these technologies enhance cybersecurity measures through proactive threat detection and efficient incident management. Additionally, the study examines the rising consumer concerns and awareness regarding data privacy and security in digital marketing, reflecting how these concerns influence business practices and the increasing demand for transparency and data control among consumers. Necessitating continuous vigilance and adaptation to protect against ever-evolving cyber threats, effective cybersecurity is indispensable in digital marketing for protection against cyber threats and as a vital element in building and maintaining consumer trust and loyalty.

A Building Model for Enhancing Information Systems Security

Today, electronic systems and information have become no less important than food and water for human life. No one can deny this fact. Electronic information systems contribute to the development of life in many areas. But some electronic information systems should not be available for anyone to use, such as reading, operating, modifying or destroying without permission. This type of electronic information systems must be protected in some way based on the related situation. . Password-based authentication is the first defense for most information systems. Password security enhances the security of the entire information system. Therefore, password protection models become very important in such cases to help users improve authentication security. Researchers published various methods based on salting, hashing, symmetric encryption, and key splitting methods. The paper conducted by Saleh Al-Asali describes a method for generating a suitable secret key that is easy to memorize and remember, as he succeeded in generating a password that is strong and easy to remember. This paper improves the previous method by adding some improvements mentioned in the section described in the suggested method.

Rethinking Smart Keyboard Layout to Aid Strong Password Creation

In an era marked by increasing digitization and the omnipresence of smartphones, the importance of robustpassword security cannot be overstated. With the ever-growing threat of cyberattacks, there is a pressing needfor user-friendly tools that facilitate the creation of strong and unique passwords. Traditional alphanumerickeyboard layouts (physical or virtual) have remained largely unchanged for decades, relying on the sameQWERTY layout initially designed for typewriters. However, these layouts may not be optimal for generatingstrong passwords. This paper focuses on tailoring virtual keyboard layouts on smartphones specifically forstrong password creation. For this, we have performed extensive user surveys to see if the presence ofdedicated rows for digits and special characters (essential in any strong password) allows users to createstronger passwords compared to regular smartphone keyboard layout. Apart from that, we also investigatedthe optimal assignment of characters, digits, and special characters and their groupings in a single soft key.The findings from the detailed user experiment suggested optimal settings for a smartphone virtual keyboard(for Android) like- diagonal length for good typing speed (approximately between 8.38 and 9.41 cm), andkey density (0.88 to 1.21 keys/cm2) which produces the least error without sacrificing the strength ofpasswords created using those layouts. We hope the outcome of this paper will help designers to aid virtualkeyboard layouts for smartphones that can motivate and create strong passwords without sacrificing usability.

Cookie Hijacking

Abstract You set a secure password, composed of random words, numbers and symbols, you turned on biometrics, and set up two-factor authentication. How were you hacked? Tim Clark MBCS explains cookie hijacking.

Comparative analysis of identity management, access control, and authorization practices in public and private universities

Background This research delves into the critical aspects of identity management, access control, and authorization practices within the domains of public and private universities. Identity management involves the meticulous management and control of user identities, encompassing the establishment and maintenance of user profiles, role assignments, and access privileges. Access control is the practice of defining and enforcing policies that govern who can access an IT system or application and which resources they can interact with. Authorization, meanwhile, determines the specific actions and privileges granted to users based on their roles and permissions. Methods To understand the variances in identity management and access control approaches, we conducted a comparative analysis between public and private universities. Our investigation scrutinized the user populations with access to university systems, the enforcement of access limitations, authentication methods, and password policies. Additionally, we examined the nuances of authorization processes, levels of authorization, access approval authorities, user status and role changes, unique user account management, account deletion procedures, user authentication methods, password complexity and expiration policies, password storage methods, and session termination policies. Results This study revealed that both public and private universities prioritize these security measures, with a common categorization of these processes. Nevertheless, there exist disparities, such as the inclusion of contractors and vendors in the user population at private universities, the manual deletion of user accounts in private institutions, and variations in password policies and storage methods. Private universities tend to enforce stricter password policies, employ more secure password storage methods, and implement automatic session termination features. Conclusions This research provides valuable insights into the practices and approaches adopted by public and private universities to safeguard their digital environments. The findings serve as a valuable resource for enhancing identity management, access control, and authorization protocols, enabling institutions to fortify their cybersecurity defenses in an ever-evolving threat landscape.

Robust password security: a genetic programming approach with imbalanced dataset handling

Robust password security: a genetic programming approach with imbalanced dataset handling

ROSTAM: A passwordless web single sign-on solution mitigating server breaches and integrating credential manager and federated identity systems

The challenge of achieving passwordless user authentication is real given the prevalence of web applications that keep asking passwords. Complicating this issue further, in an enterprise environment, a single sign-on (SSO) service is often maintained but not all applications can be integrated with it. We envision a passwordless future which provides a frictionless and trustworthy online experience for users by integrating credential management and federated identity systems. In this regard, our implementation ROSTAM offers a dashboard that presents all applications the user can access with a single click after a passwordless SSO. The security of web passwords on the credential manager is ensured with a Master Key, rather than a Master Password, so that encrypted passwords can remain secure even if stolen from the server. We propose and implement novel techniques for synchronization (pairing) and recovery of this Master Key. We compare our solution to previous work using different evaluation frameworks, demonstrating that our hybrid solution combines the benefits of credential management and federated identity systems.

A statistical Markov-based password strength meter

Although multi-factor authentication is gaining popularity, password-based authentication remains the most commonly employed method for both online login and data encryption. To help users choose secure passwords, password strength meters (PSMs) are a well-known and important tool. However, many PSMs still use simple rule sets or rely on heuristic results. With the continuous development of password-cracking methods, it is difficult for such PSMs to provide accurate assessment results. In this paper, we present a new PSM based on statistical results from a huge number of leaked passwords. The proposed method has a very simple structure, requires only a small amount of storage space, and succeeds in providing reliable feedback in real time. We also confirm the influence of linguistic features on user-created passwords and, therefore, recommend evaluating passwords based on the users’ language.

Empowering Students for Cybersecurity Awareness Management in the Emerging Digital Era: The Role of Cybersecurity Attitude in the 4.0 Industrial Revolution Era

The purpose of the study is to examine how cybersecurity knowledge, password security, and self-perception of skill affect cybersecurity awareness issues via the mediating lens of cybersecurity attitude among university students in Bangladesh. A sample of 430 university students from two public and three private universities provided the data in Dhaka, Bangladesh. An approach known as stratified random sampling was used in this cross-sectional study. The positivist approach was used, and a hypothetical statistical induction technique was used. The research constructs, which were adopted from earlier studies, were measured using scales that had undergone validation. Smart PLS-SEM 3.3.9 was used to quantitatively analyze the data. The results indicated a positive and significant association between cybersecurity knowledge and password security with cybersecurity awareness. No conventional association was found between self-perception of skills and cybersecurity awareness. Moreover, the data analysis confirmed that cybersecurity attitudemediates the relationship between cybersecurity knowledge, password security and self-perception of skills with cybersecurity awareness. This study implies that more effort needs to be put into informing the general people likely students about cybersecurity and ethical internet use. Furthermore, the main contribution of this study is to emphasize the need of raising cybersecurity awareness among students.

Comparative analysis of identity management, access control, and authorization practices in public and private universities.

This research delves into the critical aspects of identity management, access control, and authorization practices within the domains of public and private universities. Identity management involves the meticulous management and control of user identities, encompassing the establishment and maintenance of user profiles, role assignments, and access privileges. Access control is the practice of defining and enforcing policies that govern who can access an IT system or application and which resources they can interact with. Authorization, meanwhile, determines the specific actions and privileges granted to users based on their roles and permissions. To understand the variances in identity management and access control approaches, we conducted a comparative analysis between public and private universities. Our investigation scrutinized the user populations with access to university systems, the enforcement of access limitations, authentication methods, and password policies. Additionally, we examined the nuances of authorization processes, levels of authorization, access approval authorities, user status and role changes, unique user account management, account deletion procedures, user authentication methods, password complexity and expiration policies, password storage methods, and session termination policies. This study revealed that both public and private universities prioritize these security measures, with a common categorization of these processes. Nevertheless, there exist disparities, such as the inclusion of contractors and vendors in the user population at private universities, the manual deletion of user accounts in private institutions, and variations in password policies and storage methods. Private universities tend to enforce stricter password policies, employ more secure password storage methods, and implement automatic session termination features. This research provides valuable insights into the practices and approaches adopted by public and private universities to safeguard their digital environments. The findings serve as a valuable resource for enhancing identity management, access control, and authorization protocols, enabling institutions to fortify their cybersecurity defenses in an ever-evolving threat landscape.

Camguard: Preventing unauthorised camera access for women’s saftey

Online harassment is a serious problem that can have significant negative impacts on the mental health and well-being of its victims. To address this issue, an Android app has been developed that is accessible to a wide range of users worldwide. The app is built on a script backend process, providing a stable and efficient environment for data management and request processing. The app's API is integrated into the script backend process, ensuring seamless and efficient operation.During the installation process, the app requires users to go through a verification process that includes providing their Google Account, mobile number, and an OTP. This ensures that only legitimate users have access to the app's features and functions. The app also requires users to create a strong master password, which is directly connected to the Google bot, enhancing its security. Biometrics are recommended to protect the master password, ensuring that only authorized users can access their data.The app's security measures are crucial in ensuring the privacy and protection of user data. The use of biometrics and direct connection to the Google bot enhances security, and the app's API provides access to relevant information and enhances the user experience. Users can change their password securely, ensuring that only authorized users can access their data.Overall, the app is a reliable and efficient solution for managing and protecting user data. Its compatibility with a wide range of devices and seamless integration of API make it accessible to a large percentage of Android users worldwide. The app's verification process, use of biometrics, and direct connection to the Google bot enhance its security, ensuring that only authorized users have access to the app's functionalities. The development of this app is a critical step in addressing the issue of online harassment and protecting the privacy and well-being of its users.

Manager's Practical Toolkit to Improve Password Security in Organizations

Manager's Practical Toolkit to Improve Password Security in Organizations

Efficiency of using IAM system at the enterprise

The article discusses the problems on a common enterprise that does not have an Identity and Access Management system and describes the benefits which the implementation an IAM system can provide. The main components are listed and the technologies used in IAM systems are described. Effectivity of using an IAM system at the enterprise and the first steps for its implementation are analyzed. Questions that need to be answered before choosing a particular Identity and Access Management system are listed. The aim of this work is to find a solution that will eliminate the problems described in the article, and especially to optimize the employee accounting process, increase password security, and make it easier to grant access to the corporate resources. The choice of IAM solutions on the market is quite diverse. There are solutions that can be installed on company servers, as well as solutions that can be rented as cloud service (Identity as a Service). You can also build your own IAM system using open-source solutions or developing proprietary software. There are many articles in the Internet describing what Identity and Access Management is and why it is so important to use it. But these articles do not include any practical steps or specific recommendations which IAM system to choose. This article focuses on the practical side of the issue. The implementation an IAM system will accelerate the provision access to the enterprise resources for new employees, increase the security of existing information systems, and simplify the procedure for employees to log in the corporate resources before starting to work with them. Despite the difficulties related with the implementation of IAM systems and the fact that the implementation process can take a long time, the benefits of the result will compensate for all the resources spent on implementation.

A Comparative Work to Highlight the Superiority of Mouth Brooding Fish (MBF) over the Various ML Techniques in Password Security Classification

A Comparative Work to Highlight the Superiority of Mouth Brooding Fish (MBF) over the Various ML Techniques in Password Security Classification