Password Similarity Using Probabilistic Data Structures

Davide Berardi, Franco Callegati, Andrea Melis, Marco Prandini
2020 Journal of Cybersecurity and Privacy  
Passwords should be easy to remember, yet expiration policies mandate their frequent change. Caught in the crossfire between these conflicting requirements, users often adopt creative methods to perform slight variations over time. While easily fooling the most basic checks for similarity, these schemes lead to a substantial decrease in actual security, because leaked passwords, albeit expired, can be effectively exploited as seeds for crackers. This work describes an approach based on Bloom
more » ... ters to detect password similarity, which can be used to discourage password reuse habits. The proposed scheme intrinsically obfuscates the stored passwords to protect them in case of database leaks, and can be tuned to be resistant to common cryptanalytic techniques, making it suitable for usage on exposed systems.
doi:10.3390/jcp1010005 fatcat:ka5d7iu74vbcdolu7zkyh6j6pa