What's in a name? Evaluating statistical attacks on personal knowledge questions

Joseph Bonneau; Mike Just; Greg Matthews

doi:10.1007/978-3-642-14577-3_10

What's in a name? Evaluating statistical attacks on personal knowledge questions

Joseph Bonneau, Mike Just, Greg Matthews

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

We study the efficiency of statistical attacks on human authentication systems relying on personal knowledge questions. We adapt techniques from guessing theory to measure security against a trawling attacker attempting to compromise a large number of strangers' accounts. We then examine a diverse corpus of real-world statistical distributions for likely answer categories such as the names of people, pets, and places and find that personal knowledge questions are significantly less secure than graphical or textual passwords. We also demonstrate that statistics can be used to increase security by proactively shaping the answer distribution to lower the prevalence of common responses.

Original language	English (US)
Title of host publication	Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers
Pages	98-113
Number of pages	16
DOIs	https://doi.org/10.1007/978-3-642-14577-3_10
State	Published - 2010
Event	14th International Conference on Financial Cryptography and Data Security, FC 2010 - Tenerife, Canary Islands, Spain Duration: Jan 25 2010 → Jan 28 2010

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	6052 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Other

Other	14th International Conference on Financial Cryptography and Data Security, FC 2010
Country/Territory	Spain
City	Tenerife, Canary Islands
Period	1/25/10 → 1/28/10

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-642-14577-3_10

Cite this

Bonneau, J., Just, M., & Matthews, G. (2010). What's in a name? Evaluating statistical attacks on personal knowledge questions. In Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers (pp. 98-113). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6052 LNCS). https://doi.org/10.1007/978-3-642-14577-3_10

What's in a name? Evaluating statistical attacks on personal knowledge questions. / Bonneau, Joseph; Just, Mike; Matthews, Greg.
Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers. 2010. p. 98-113 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6052 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Bonneau, J, Just, M & Matthews, G 2010, What's in a name? Evaluating statistical attacks on personal knowledge questions. in Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 6052 LNCS, pp. 98-113, 14th International Conference on Financial Cryptography and Data Security, FC 2010, Tenerife, Canary Islands, Spain, 1/25/10. https://doi.org/10.1007/978-3-642-14577-3_10

Bonneau J, Just M, Matthews G. What's in a name? Evaluating statistical attacks on personal knowledge questions. In Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers. 2010. p. 98-113. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-642-14577-3_10

Bonneau, Joseph ; Just, Mike ; Matthews, Greg. / What's in a name? Evaluating statistical attacks on personal knowledge questions. Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers. 2010. pp. 98-113 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{83c7166abd1b4feead7ef84fa7efae9a,

title = "What's in a name? Evaluating statistical attacks on personal knowledge questions",

abstract = "We study the efficiency of statistical attacks on human authentication systems relying on personal knowledge questions. We adapt techniques from guessing theory to measure security against a trawling attacker attempting to compromise a large number of strangers' accounts. We then examine a diverse corpus of real-world statistical distributions for likely answer categories such as the names of people, pets, and places and find that personal knowledge questions are significantly less secure than graphical or textual passwords. We also demonstrate that statistics can be used to increase security by proactively shaping the answer distribution to lower the prevalence of common responses.",

author = "Joseph Bonneau and Mike Just and Greg Matthews",

year = "2010",

doi = "10.1007/978-3-642-14577-3_10",

language = "English (US)",

isbn = "3642145760",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "98--113",

booktitle = "Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers",

note = "14th International Conference on Financial Cryptography and Data Security, FC 2010 ; Conference date: 25-01-2010 Through 28-01-2010",

}

TY - GEN

T1 - What's in a name? Evaluating statistical attacks on personal knowledge questions

AU - Bonneau, Joseph

AU - Just, Mike

AU - Matthews, Greg

PY - 2010

Y1 - 2010

N2 - We study the efficiency of statistical attacks on human authentication systems relying on personal knowledge questions. We adapt techniques from guessing theory to measure security against a trawling attacker attempting to compromise a large number of strangers' accounts. We then examine a diverse corpus of real-world statistical distributions for likely answer categories such as the names of people, pets, and places and find that personal knowledge questions are significantly less secure than graphical or textual passwords. We also demonstrate that statistics can be used to increase security by proactively shaping the answer distribution to lower the prevalence of common responses.

AB - We study the efficiency of statistical attacks on human authentication systems relying on personal knowledge questions. We adapt techniques from guessing theory to measure security against a trawling attacker attempting to compromise a large number of strangers' accounts. We then examine a diverse corpus of real-world statistical distributions for likely answer categories such as the names of people, pets, and places and find that personal knowledge questions are significantly less secure than graphical or textual passwords. We also demonstrate that statistics can be used to increase security by proactively shaping the answer distribution to lower the prevalence of common responses.

UR - http://www.scopus.com/inward/record.url?scp=77955315492&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=77955315492&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-14577-3_10

DO - 10.1007/978-3-642-14577-3_10

M3 - Conference contribution

AN - SCOPUS:77955315492

SN - 3642145760

SN - 9783642145766

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 98

EP - 113

BT - Financial Cryptography and Data Security - 14th International Conference, FC 2010, Revised Selected Papers

T2 - 14th International Conference on Financial Cryptography and Data Security, FC 2010

Y2 - 25 January 2010 through 28 January 2010

ER -

What's in a name? Evaluating statistical attacks on personal knowledge questions

Abstract

Publication series

Other

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this