"Honeywords" have emerged as a promising defense mechanism for detecting data
breaches and foiling offline dictionary attacks (ODA) by deceiving attackers
with false passwords. In this paper, we propose PassFilter, a novel deep
learning (DL) based attack framework, fundamental in its ability to identify
passwords from a set of sweetwords associated with a user account, effectively
challenging a variety of honeywords generation techniques (HGTs). The DL model
in PassFilter is trained with a set of previously collected or adversarially
generated passwords and honeywords, and carefully orchestrated to predict
whether a sweetword is the password or a honeyword. Our model can compromise
the security of state-of-the-art, heuristics-based, and representation
learning-based HGTs proposed by Dionysiou et al. Specifically, our analysis
with nine publicly available password datasets shows that PassFilter
significantly outperforms the baseline random guessing success rate of 5%,
achieving 6.10% to 52.78% on the 1st guessing attempt, considering 20
sweetwords per account. This success rate rapidly increases with additional
login attempts before account lock-outs, often allowed on many real-world
online services to maintain reasonable usability. For example, it ranges from
41.78% to 96.80% for five attempts, and from 72.87% to 99.00% for ten attempts,
compared to 25% and 50% random guessing, respectively. We also examined
PassFilter against general-purpose language models used for honeyword
generation, like those proposed by Yu et al. These honeywords also proved
vulnerable to our attack, with success rates of 14.19% for 1st guessing
attempt, increasing to 30.23%, 41.70%, and 63.10% after 3rd, 5th, and 10th
guessing attempts, respectively. Our findings demonstrate the effectiveness of
DL model deployed in PassFilter in breaching state-of-the-art HGTs and
compromising password security based on ODA.

使用深度学习的攻击框架 PassFilter 能够成功地破解和损害最先进的蜜语生成技术并且危及密码安全。

当人工智能打败密码欺骗时！一种深度学习框架用于区分密码和诱饵密码

When AI Defeats Password Deception! A Deep Learning Framework to  Distinguish Passwords and Honeywords

Honeywords are fictitious passwords inserted into databases in order to
identify password breaches. The major difficulty is how to produce honeywords
that are difficult to distinguish from real passwords. Although the generation
of honeywords has been widely investigated in the past, the majority of
existing research assumes attackers have no knowledge of the users. These
honeyword generating techniques (HGTs) may utterly fail if attackers exploit
users' personally identifiable information (PII) and the real passwords include
users' PII. In this paper, we propose to build a more secure and trustworthy
authentication system that employs off-the-shelf pre-trained language models
which require no further training on real passwords to produce honeywords while
retaining the PII of the associated real password, therefore significantly
raising the bar for attackers.
We conducted a pilot experiment in which individuals are asked to distinguish
between authentic passwords and honeywords when the username is provided for
GPT-3 and a tweaking technique. Results show that it is extremely difficult to
distinguish the real passwords from the artifical ones for both techniques. We
speculate that a larger sample size could reveal a significant difference
between the two HGT techniques, favouring our proposed approach.

使用预训练语言模型构建的身份验证系统，生成包含个人身份信息的 honeywords，难以被攻击者区分，从而提高密码保护的安全性。