The DOI matches its Crossref record; 23 of the 23 references it cites were found in a registry or an index.
Targeted Online Password Guessing: An Underestimated Threat
Open accessAbstract
While trawling online/offline password guessing has been intensively studied, only a few studies have examined targeted online guessing, where an attacker guesses a specific victim's password for a service, by exploiting the victim's personal information such as one sister password leaked from her another account and some personally identifiable information (PII). A key challenge for targeted online guessing is to choose the most effective password candidates, while the number of guess attempts allowed by a server's lockout or throttling mechanisms is typically very small. We propose TarGuess, a framework that systematically characterizes typical targeted guessing scenarios with seven sound mathematical models, each of which is based on varied kinds of data available to an attacker. These models allow us to design novel and efficient guessing algorithms. Extensive experiments on 10 large real-world password datasets show the effectiveness of TarGuess. Particularly, TarGuess I~IV capture the four most representative scenarios and within 100 guesses: (1) TarGuess-I outperforms its foremost counterpart by 142% against security-savvy users and by 46% against normal users; (2) TarGuess-II outperforms its foremost counterpart by 169% on security-savvy users and by 72% against normal users; and (3) Both TarGuess-III and IV gain success rates over 73% against normal users and over 32% against security-savvy users. TarGuess-III and IV, for the first time, address the issue of cross-site online guessing when given the victim's one sister password and some PII.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords
Bonneau, J. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.49 · Cited by 687
Password Cracking Using Probabilistic Context-Free Grammars
Weir, M., Aggarwal, S., Medeiros, B. D., & Glodek, B. (2009) · 2009 30th IEEE Symposium on Security and Privacy · doi:10.1109/sp.2009.8 · Cited by 524
Fast dictionary attacks on passwords using time-space tradeoff
Narayanan, A., & Shmatikov, V. (2005) · Proceedings of the 12th ACM conference on Computer and communications security · doi:10.1145/1102120.1102168 · Cited by 447
The Tangled Web of Password Reuse
Das, A., Bonneau, J., Caesar, M., Borisov, N., & Wang, X. (2014) · Proceedings 2014 Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23357 · Cited by 437
A Study of Probabilistic Password Models
Ma, J., Yang, W., Luo, M., & Li, N. (2014) · 2014 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2014.50 · Cited by 261
Passwords and the evolution of imperfect authentication
Bonneau, J., Herley, C., van Oorschot, P. C., & Stajano, F. (2015) · Communications of the ACM · doi:10.1145/2699390 · Cited by 258
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks
Melicher, W., Ur, B., Segreti, S. M., Komanduri, S., Bauer, L., Christin, N., & Cranor, L. F. (2016) · USENIX Security Symposium · Cited by 252
Measuring password guessability for an entire university
Mazurek, M. L., Komanduri, S., Vidas, T., Bauer, L., Christin, N., Cranor, L. F., Kelley, P. G., Shay, R., & Ur, B. (2013) · Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13 · doi:10.1145/2508859.2516726 · Cited by 219
Does my password go up to eleven?: the impact of password meters on password selection
Egelman, S., Sotirakopoulos, A., Muslukhov, I., Beznosov, K., & Herley, C. (2013) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/2470654.2481329 · Cited by 197
On the Semantic Patterns of Passwords and their Security Impact
Veras, R., Collins, C., & Thorpe, J. (2014) · Proceedings 2014 Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23103 · Cited by 183
Cited by
Two birds with one stone: two-factor authentication with security beyond conventional bound
Wang, D., & Wang, P. (2016) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2016.2605087 · Cited by 539
Self-citationWang, D., Cheng, H., Wang, P., Huang, X., & Jian, G. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2721359 · Cited by 499
Self-citationSrinivas, J., Das, A. K., Kumar, N., & Rodrigues, J. J. P. C. (2019) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2019.2911672 · Cited by 305
Wang, D., Li, W., & Wang, P. (2018) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2018.2834351 · Cited by 272
Self-citationQiu, S., Wang, D., Xu, G., & Kumari, S. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3022797 · Cited by 224
Self-citation
Metadata
- Authors
- Wang, D., Zhang, Z., Wang, P., Yan, J., & Huang, X.
- Venue
- Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2016-10-24
- Pages
- 1242-1254
- OpenAlex
- W2538793708
- Cited by
- 323
- References
- 23
- FWCI
- 27.64
- Type
- conference paper
- Language
- en
- Open access
- green
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Targeted Online Password Guessing: An Underestimated Threat. https://app.cochat.ai/papers/10.1145/2976749.2978339
- The paper
- Wang, D., Zhang, Z., Wang, P., Yan, J., & Huang, X. (2016). Targeted Online Password Guessing: An Underestimated Threat. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. https://doi.org/10.1145/2976749.2978339
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
