Password Security Research Articles

Security Measures in IoT Devices, Including Wireless Medical Devices

The exponential growth in global adoption of the internet of things (IoT) has resulted in increasing challenges to secure devices against the rapid escalation of malicious users and external attacks. Security of IoT devices is particularly critical in the medical sector, where data breaches have become common in recent years at healthcare facilities, medical laboratories, and medical insurance companies. The phenomenological study focused on the experiences of users of IoT devices and the adoption of effective security measures in IoT devices, especially wireless medical devices. The results from this research study indicated that there was a need for policymakers to be more aware of the security issues that plague some IoT devices, including the need for training to detect potential breaches and cybersecurity aberrations, improved features for protection of devices, and better password security. The study concludes with recommendations for policymakers and device manufacturers.

Leet Usage and Its Effect on Password Security

Text-based passwords have long acted as the dominating authentication method. Leet, as one of the significant components in password, has not been paid enough attention yet. In this paper, we systematically study the presence of Leet in passwords. We define single and pattern forms of Leet and propose a matching approach to check whether a user password contains Leet. We extract the most prevalent counterpart pairs of Leet manifestations. Afterward, we examine the effect of Leet in passwords by incorporating Leet transformation into the probabilistic context-free grammar(PCFG) method to crack passwords. We construct the first comprehensively analyzed dictionary of Leets for passwords, which is confirmed suitable for most datasets by user survey. Experiments on four leaked password sets demonstrate that distinguished Leet usage accumulates to account for around 1% of the total dataset. Only 5% of high-frequency Leets replacement could increase the cracking rate by 0.55%. For crackers, incorporating popular Leets aids to improve password cracking performance. For users, adopting low-frequency Leets could strengthen their passwords. This research provides a new perspective to investigate Leet transformations in passwords.

Adaptive Thresholds of EEG Brain Signals for IoT Devices Authentication

In this paper, a new authentication method has been proposed for the Internet of Things (IoT) devices. This method is based on electroencephalography EEG signals, and hand gestures. The proposed EEG signals authentication method used a low price NeuroSky MindWave headset. This was based on choosing the adaptive thresholds of attention and meditation mode for the authentication key. Hand gestures to control authentication processes by using a general camera. To verify that a new authentication method is widely accepted, it must meet two main conditions, security and usability. The evaluation of the prototype usability was based on ISO 9241-11:2018 standards usability model. Results revealed that the proposed method demonstrated the usability of authentication by using EEG signals with the accuracy of 92%, the efficiency of 93%, and user satisfaction is acceptable and satisfying. To evaluate the security of the prototype, we consider the most important three threats related to IoT devices which they are guessing, physical observation, and targeted impersonation. The results showed that the password strength, using the proposed system is stronger than the traditional keyboard. The proposed authentication method also is resistant to target impersonation and physical observation.

Exploratory Data Analysis on Username-Password Dataset

Passwords act as a first line of defense against any malicious or unauthorized access to one's personal information. With the increasing digitization, it has now become even more important to choose strong passwords. In this paper, the authors analyze a 100 million Email-Password Database to perform Exploratory Data Analysis. The analysis provides valuable insights on statistics about the most common passwords being used, character set of passwords, most common domains, average length, password strength, frequencies of letters, numbers, symbols (special characters), most common letter, most common number, most common symbol, the ratio of letters, numbers, symbols in passwords which highlights the general trend that users follow while creating passwords. Using the results of this paper, users can make intelligent decisions while creating passwords for themselves, i.e., not opting for the most common features that will help them create robust and less vulnerable passwords.

RLS-PSM: A Robust and Accurate Password Strength Meter Based on Reuse, Leet and Separation

Password strength meters (PSMs) are being widely used, but they often give conflicting, inaccurate and misleading feedback, which defeats their purpose. Except for fuzzyPSM, all PSMs assume passwords are newly constructed, which is not true in reality. FuzzyPSM considers password reuse, six major leet transformations and initial capitalization, and performs the best as evaluated by Golla and Durmuth at ACM CCS’18. On the basis of fuzzyPSM, we propose a new PSM based on R euse, L eet and S eparation, namely RLS-PSM. First, we classify password reuse behaviors into capitalization and those that use special characters for leet or separation, and calculate the corresponding probabilities. Then, to balance efficiency and precision, we use Long Short-Term Memory to calculate the probabilities of alphanumeric strings. Besides, we propose to use benchmark passwords to show the relative strength of a password. Due to the varied impacts of different service types and diversified economic value of websites, we consider parameter settings of RLS-PSM under six different service types. Finally, we use the Monte Carlo method and weighted Spearman coefficient to measure and compare the robustness and accuracy of RLS-PSM, leading PSMs (including Markov-based PSM, PCFG-based PSM, fuzzyPSM, RNN, and Zxcvbn), and password cracking tools (including JtR and Hashcat). We find that the robustness of RLS-PSM is significantly higher than all counterparts when evaluating attempts > 104 (e.g., on average, Fraction of Successfully Evaluated passwords of RLS-PSM is 18.9% higher than fuzzyPSM). The accuracy of RLS-PSM is also better than other mainstream PSMs used for comparison in this paper, except for fuzzyPSM.

Cybersecurity Challenges and Governance Issues in the Cyberspace 'When Stronger Passwords Are not Enough: Governing Cyberspace in Contemporary African Nations' Case Study: Can South Africa and Nigeria Secure Cyberspace without a Lock?

Policing Cyberspace in South Africa and Nigeria: Challenges and Opportunities The banking sector, as a centralized aspect of contemporary digital finance systems, is a vulnerable target. Not surprisingly, recent data indicate that cyberattacks have augmented by 300% over the past three years in Africa (Open Access Government). As per Kris Budnik and Kent Kirkwood, leaders in Cybersecurity services for PwC South Africa, this dramatic rise roots in “the tremendous value of information financial services they hold” (Budnik and Kirkwood). This trend was facilitated by the integration of “internet-based” transactions in the banking system, and ramping up internet penetration rates in countries like South Africa and Nigeria (Open Access Government). According to a 2020 McKinsey report, banks seek to expand market share by advertising the accessibility and popularity of their online services. Banks offer Mobile Financial Services (MFS), which include a range of services from payments, loans, investments, to insurance (Kola-Oyeneyin et al.). As evidenced in Exhibit 1, after South Africa reached the 100 million threshold, mobile money deployments have comprised the largest share of accounts (Kola-Oyeneyin et al.). The complexity of cyberspace and the sophistication of criminal actors creates numerous opportunities for potential abuse. As a result, it is in a society’s best interests to ensure that effective regulations are in place. When a cybercrime is committed, financial institutions suffer theft of funds, weakening of intellectual property, and loss of other valuable assets along with legitimacy. To combat cybercrime, emerging cashless economies need to invest in education and technology to tailor cybersecurity strategies to the local, regional, and international contexts. Since 2014, South Africa and Nigeria have taken a regional lead in developing and implementing financial technology. Unsurprisingly, South Africa is now considered “a new cybercrime harbor” (Open Access Government). Both countries are highly vulnerable to cyberattacks, which creates an interesting trend to monitor.

The Impact of Keyboard Type on Users' Perceptions of Password Strength

With the proliferation of mobile touchscreen computers, password entry no longer takes place exclusively on physical keyboards. Entering a strong password on a mobile device requires a person to navigate through multiple keyboard depths to access each character, while entering the same password on a desktop keyboard only requires a user to press keys that are accessible on a single layer. This paper investigates whether the extra physical and cognitive effort associated with using multiple levels of onscreen keyboards changes users' perceptions of password strength. Sixty participants judged perceived security by typing 36 passwords with a differing number of keyboard level transitions on either a mobile device or a desktop keyboard. Analysis revealed that passwords requiring a user to transition between keyboards increased perceptions of security. Passwords that required the use of the shift key on a desktop keyboard returned similar results. This suggests that users may overestimate the security of passwords based on the number of entry keystrokes.

Cryptography Implementation for electronic voting security

Electronic voting is done by recording election data centrally and presenting it into fast digital information. E-voting is an internet technology, which aims to improve the performance of the voting process, and is expected to be a breakthrough in technological development that helps human work. Security constraints in e-voting include the distribution of voting, for example voters who distribute voting rights, are illegitimate and can abuse voters’ rights, because they know the voter’s account to access the system. This study implements cryptographic methods as a password security for voter accounts, and the results of voting, so that the secrecy of the voters’ data and the results of voting are maintained. RSA algorithm to implement cryptographic techniques based on two mathematical problems, namely factorization and modulo operations on composite numbers, which use two different keys for encryption and decryption processes. The public key is used encryption process to encode text, and the private key is used description process, namely translating ciphertext into plaintext.

Understanding Information Security Policy Violation from a Situational Action Perspective

Insiders’ negligence or abuse is regarded as a leading cause of information security breaches in organizations. As most of the extant studies have largely examined insider threats at a high level of abstraction, the role of situational moral reasoning for information security policy (ISP) violations in specific situations has received little attention. To advance this line of research, this paper opens up a potentially fruitful path for IS researchers by applying situational action theory (SAT) to contextually examine why employees violate ISPs in particular situations. We consider the violations of password security policy, internet use policy, and confidential data security policy, and examine specific violation intents ranging from altruistic to malicious. The results support most of the assertions derived from SAT. We found situational moral beliefs to be the predominant driver for ISP violations across three situations in an organizational setting. However, the moderation effect of moral beliefs was only significant in situations involving sharing passwords and selling confidential data. Sanction certainty and sanction severity were also found to have different effects across situations. We conclude by presenting implications for IS security practitioners and suggestions for future research.

Захист інформації відомчої інформаційно-телекомунікаційної мережі за допомогою парольної системи

The approach to quantitative estimation of stability of password systems taking into account power of space of passwords and length of the password is theoretically substantiated. The formalized idea of information entropy as an approach to measuring the amount of information that is unknown through random variables is determined by the randomness of a variable based on the knowledge contained in another part of the message. It is established that the greater the entropy in a given distribution of passwords, the more difficult it is to guess the password that was chosen from this distribution; passwords with higher entropy values require more expected assumptions, which makes entropy useful as a measure of password strength. Proposals for password management of the departmental information and telecommunication network of the object of critical information infrastructure are given. Studies show that much of the entropy introduced by uppercase and lowercase characters is created by users who exceed the minimum requirements of the password strength policy. Secure password creation is complicated by the trade-off between developing passwords that are both difficult to crack and use. Accordingly, the access control policy is important. Studies show that much of the entropy introduced by large and non-alphanumeric characters is created by users who exceed the minimum requirements of the password strength policy: the use of more digits than necessary, different positions of special characters. It is concluded that text passwords remain the dominant method of authentication in computer systems, despite significant improvements, including smart cards, RFID cards, USB tokens and graphic passwords, which have their advantages and are suitable for use in a particular environment or for a specific program. It is noted that there are few published empirical studies that would examine the strategies used by users under different password policies. Further research is planned in this direction/

Password as a Special case of "Man-machine" Communication. A Pragmatic approach

The authorization on sites, in social networks and personal accounts with passwords is an extremely common practice today. It has become an integral part of people's lives, even they are not aware of it. But despite this, most Internet users have difficulties in creating and remembering of the strong passwords. This article analyzes the problem using the speech act theory of John Austin and John Searle. It allows to shed light on a person's behaviour on the Internet and his reaction to the question "Who is there?", which the machine asks him.

On-Air Hand-Drawn Doodles for IoT Devices Authentication During COVID-19

In this paper, a new natural human interaction authentication method is proposed for Internet of Things (IoT) devices. In this method, the user draws a doodle on the air for authentication. On-air drawing refers to virtually drawing free hand-drawn doodle passwords through hand gestures on the air without touching anything that is recommended during COVID-19. This study uses the Google Quick Draw Doodle dataset for password doodles. The proposed method is based on a typical video camera, two lightweight convolutional neural networks (CNNs) and a Kalman filter. The first CNN for hand gesture classification was used to overcome dynamic hand gesture challenges on the air. Second CNN for authentication verification. A Kalman filter was used to correct and smooth the path drawn on the air. Two main goals must be achieved to accept the new authentication method: usability and security. The usability evaluation was based on the ISO 9241-11:2018 standard usability model. The results revealed that the accuracy of the proposed authentication method was 95%, efficiency was 94%, and user satisfaction was acceptable. The evaluation of security was based on two threats related to IoT devices: guessing and physical observation. The results show that the password strength of the proposed authentication method is stronger than the traditional 4-digits PIN password. The proposed authentication method is also resistant to physical observation threats.

Introducing a Machine Learning Password Metric Based on EFKM Clustering Algorithm

we introduce a password strength metric using Enhanced Fuzzy K-Means clustering algorithm (EFKM henceforth). The EFKM is trained on the OWASP list of 10002 weak passwords. After that, the optimized centroids are maximized to develop a password strength metric. The resulting meter was validated by contrasting with three entropy-based metrics using two datasets: the training dataset (OWASP) and a dataset that we collected from github website that contains 5189451 leaked passwords. Our metric is able to recognize all the passwords from the OWASP as weak passwords only. Regarding the leaked passwords, the metric recognizes almost the entire set as weak passwords. We found that the results of the EFKM-based metric and the entropy-based meters are consistent. Hence the EFKM metric demonstrates its validity as an efficient password strength checker.

Implementation of rotary parking system model using wi-fi as transmission media

The increasing population in Indonesia affects the increase in private and public vehicles. This increase in vehicles causes various problems, one of which is the need for parking space. The need for parking space raises various other problems, namely, the reduction in green open land and rampant illegal parking on the side of the road which often causes congestion. Then we designed and implemented a model of the rotary parking system using Wi-Fi as transmission media. This model is expected to be developed further in solving the problem of parking space requirements. This system begins to work when a user logs in using a previously registered ID and password. The user then selects a particular deck through the built application on the smartphone. The user-selected deck will spin and stop so that the user’s vehicle can enter into. After the vehicle is parked, the user reconfirms the control device and the security password will automatically be sent to the user’s smartphone. To pick up the vehicle again, the user will enter the given password into the control device.

Modified Password Guessing Methods Based on TarGuess-I

TarGuess − I is a leading online targeted password guessing model using users’ personally identifiable information (PII) proposed at ACM CCS 2016 by Wang et al. It has attracted widespread attention in password security owing to its superior guessing performance. Yet, after analyzing the users’ vulnerable behaviors of using popular passwords and constructing passwords with users’ PII, we find that this model does not take into account popular passwords, keyboard patterns, and the special strings. The special strings are the strings related to users but do not appear in the users’ demographic information. Thus, we propose TarGuess − I + K P X , a modified password guessing model with three semantic methods, including (1) identifying popular passwords by generating top-300 lists from similar websites, (2) recognizing keyboard patterns by relative position, and (3) catching the special strings by extracting continuous characters from user-generated PII. We conduct a series of evaluations on six large-scale real-world leaked password datasets. The experimental results show that our modified model outperforms TarGuess − I by 2.62% within 100 guesses.

Authentication and password storing improvement using SXR algorithm with a hash function

Secure password storing is essential in systems working based on password authentication. In this paper, SXR algorithm (Split, Exclusive OR, and Replace) was proposed to improve secure password storing and could also be applied to current authentication systems. SXR algorithm consisted of four steps. First, the received password from users was hashed through a general hash function. Second, the ratio and the number of iterations from the secret key (username and password) were calculated. Third, the hashed password and ratio were computed, and the hashed password was divided based on the ratio (Split) into two values. Both the values were applied to XOR equation according to the number of iterations, resulting in two new values. Last, the obtained values were concatenated and stored in the database (Replace). On evaluating, complexity analyses and comparisons has shown that SXR algorithm could provide attack resistance with a stronger hashed password against the aforementioned attacks. Consequently, even if the hackers hacked the hashed password, it would be challenging and would consume more time to decrypt the actual one, because the pattern of the stored password is the same as the one that has been hashed through the general hash function.

Public Awareness on How Vape is used as a Tool for Hacking

Nowadays e-cigarettes and vaping devices are more popular than tobacco cigarettes among the youngsters. Most of the youngsters falsely believe that vaping is safer than tobacco and it is trendier. This research paper is reviewing on how vape is used as a tool for hacking. Based on research, vaping is not only give bad impact to the health but it is also can be used as a medium in transferring malware and to breach the computer system security. A few tweaks and modification of the vape device could make the attacker to transfer the malware to the computer system. Literature review being done on several electronic smoking devices such as e-cigarettes, vaping and JUUL. Statistic on vape users and vape hackers are being done. On top of that questionnaire being prepared and distributed to the public to analyse on public awareness on vape hacking. The method of vape hacking and protection from vaping hackers are also being discuss in this paper. Since vape is using USB to charge the device hence security measures focus more on USB security on how to protect the computer system from the vaping hackers. Several methods can be applied such as disable USB drives and mass storage devices using registry, keep security patches updated, create strong password, control the USB port through device manager or by using a free tool USB drive Disabler/Enabler. There are many others security protection can be implemented but this paper only focuses on several methods as discussed.

An Efficient Security Model for Password Generation and Time Complexity Analysis for Cracking the Password

Passwords tend to be one of the most popular approaches to protect operating systems and user’s data also. Most businesses rely on password protection schemes, and secure passwords are incredibly necessary to them. The proposed model typically aims to impose protection by forcing users to obey protocols to build passwords. For user protection, password has become a prevailing method in terms of exposure to scarce tools. The main problem with password is its consistency or power, i.e. how simple (or how difficult) a third person can be "assumed" to enter the tool that you use while claiming to be you. In operating systems, text-based passwords remain the primary form of authentication, following major improvements in attackers' skills in breaking passwords. The proposed Random Character Utilization with Hashing (RCUH) is used for generation of new passwords by considering user parameters. The proposed model introduces a new framework to design a password by considering nearly 10 parameters from the user and also analyze the time for cracking the generated password to provide the system strength. The proposed model aims to generate an efficient security model for password generation by considering several secret parameters from the user. To break a set of consistency passwords, analysis is also performed on time for password cracking. The tests show a close positive correlation between guessing complexity and password consistency. The proposed model is compared with the traditional password generation and cracking models. The proposed model takes much time in cracking the password that improves the systems security.

Information Security Awareness among youth in Klang Valley: A Focus Group Discussion

Issues on the lack of understanding on the awareness of information security among the Internet user has become central debate now a day. User’s ignorance and negligence towards awareness of information security, may lead to being the victim of cybercrime syndicates. This can be clearly seen through the increase of number in cybercrime statistics in Malaysia. Internet users has been scammed, cyberbullying and faced loss amount of money due to their unawareness of information security. The purpose of this study is to look at the youth understanding of information security awareness. Based on the focus group discussion with a total of 20 informants among youth, this research try to obtain the youth perspective and understanding on information security awareness. Using convenience sampling, youth were chosen as informants since they are mostly engaged with new media compared to other age groups. Discussions were audio-recorded, transcribed verbatim, and analyzed using thematic analysis. Results show that there were few themes emerge on the awareness of information security, such as secure password usage, information sharing, safe online shopping website, and safe online banking website. Generally, most of the youth have a basic knowledge on information security awareness, particularly on having a secure password usage and information sharing. This study on the other hand, creates awareness on the important of information security, thus educated them to become a safe Internet user. Future study emphasizing on the government’s role in regulating the cybercrime issues and educating smart device users towards safe Internet usage is recommended.

Password Substantiation with Negative Password Encryption

Secure secret password storage is an essential perspective in frameworks dependent on secret phrase Substantiation method, which is as yet the most broadly utilized Substantiation confirmation procedure, in spite of its some security imperfections. In this paper, a secret key Substantiation architecture structure is implemented that is intended for secure secret password storage and could be effectively incorporated into existing authentication frameworks. In this framework first the plain password which is received from the customer is given to cryptographic hash component for SHA-256 cryptographic process. After this, the hashed secret password is changed over into a negative secret password phrase. At last, the negative password is encoded/encrypted into an Encrypted Negative Password (ENP) utilizing a symmetric-key computation using for example, AES, and additionally to improve security, multi-repeated encryption could be utilized. The cryptographic hash function and symmetric encryption make it hard to break passwords from ENPs. Also, it provides lots of comparing ENPs for a given plain password, which makes pre-calculation intrusions (e.g., and rainbow table intrusion and query table attacks) infeasible. The complex calculations and comparisons of the algorithm provide good resistance towards intrusions and also provide stronger password protection. The proposed and implemented mechanism for Password Substantiation with Negative Password Encryption is a good secured password protection mechanism that merges cryptographic hash function, the negative password and the symmetric-key algorithm, without the requirement for extra data from the plain password.