Advancing Honeywords for Real-World Authentication Security

• URL: http://arxiv.org/abs/2510.22971v1
• Date: Mon, 27 Oct 2025 03:44:20 GMT
• Title: Advancing Honeywords for Real-World Authentication Security
• Abstract summary: Honeywords are decoy passwords stored alongside a real password.<n>Despite over a decade of research, this technique has not been adopted by major authentication platforms.<n>This paper argues that the core concept of Honeywords has potential but requires more research on issues such as flatness, integration, and reliability.
• Score: 3.627954884906034
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Introduced by Juels and Rivest in 2013, Honeywords, which are decoy passwords stored alongside a real password, appear to be a proactive method to help detect password credentials misuse. However, despite over a decade of research, this technique has not been adopted by major authentication platforms. This position paper argues that the core concept of Honeywords has potential but requires more research on issues such as flatness, integration, and reliability, in order to be a practical deployable solution. This paper examines the current work on Honeyword generation, attacker modeling, and honeychecker architecture, analyzing the subproblems that have been addressed and ongoing issues that prevent this system from being more widely used. The paper then suggests a deployable framework that combines the attacker-resilient, context-aware decoy creation that Honeywords provide with easy integration into existing systems. Honeywords will only move from an academic idea to a practical security tool if technical advances are paired with secure and straightforward architectures, along with adaptive response handling and detailed configuration checks.

Related papers

• Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs [61.39153106347947]
  Large language model safeguards decide whether to answer before seeing how an answer will be used.<n>This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history.<n>We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers.
  arXiv  Detail & Related papers  (2026-07-30T09:59:08Z)
• Scalable Secure Biometric Authentication without Auxiliary Identifiers [54.032594016239926]
  We present a new biometric authentication system that provides provable security guarantees against data breaches.<n>Our work is the first to show that real-world scalable privacy-preserving biometric authentication without auxiliary identifiers is feasible.
  arXiv  Detail & Related papers  (2026-04-27T23:55:09Z)
• How Blind and Low-Vision Users Manage Their Passwords [58.76726339294067]
  This paper investigates how Blind and Low-Vision (BLV) users tackle password management.<n>We found that all participants utilize password managers to some extent, which they perceive as fairly accessible.<n>The security advantages - generating strong, random passwords - were avoided mainly due to the absence of practical accessibility.
  arXiv  Detail & Related papers  (2025-10-15T13:33:45Z)
• System Password Security: Attack and Defense Mechanisms [4.188145506259564]
  In recent years, frequent password cracking attacks targeting system passwords have posed a severe threat to information system security.<n>This paper conducts systematic research on system password security, focusing on analyzing typical password cracking methods.<n>It also evaluates widely adopted defense mechanisms, including account lockout policies, multi-factor authentication, and risk adaptive authentication.
  arXiv  Detail & Related papers  (2025-10-11T15:01:58Z)
• Paper Summary Attack: Jailbreaking LLMs through LLM Safety Papers [61.57691030102618]
  We propose a novel jailbreaking method, Paper Summary Attack (llmnamePSA)<n>It synthesizes content from either attack-focused or defense-focused LLM safety paper to construct an adversarial prompt template.<n>Experiments show significant vulnerabilities not only in base LLMs, but also in state-of-the-art reasoning model like Deepseek-R1.
  arXiv  Detail & Related papers  (2025-07-17T18:33:50Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• Practical Acoustic Eavesdropping On Typed Passphrases [0.0]
  This paper exploits keyboard acoustic emanations to infer typed natural language passphrases via unsupervised learning.<n>It is also applicable to longer messages, such as confidential emails, where the margin for error is much greater.<n>Cross-correlation audio preprocessing outperforms methods like mel-frequency-cepstral coefficients and fast-fourier transforms in keystroke clustering.
  arXiv  Detail & Related papers  (2025-03-20T21:42:30Z)
• BiCert: A Bilinear Mixed Integer Programming Formulation for Precise Certified Bounds Against Data Poisoning Attacks [62.897993591443594]
  Data poisoning attacks pose one of the biggest threats to modern AI systems.<n>Data poisoning attacks pose one of the biggest threats to modern AI systems.<n>Data poisoning attacks pose one of the biggest threats to modern AI systems.
  arXiv  Detail & Related papers  (2024-12-13T14:56:39Z)
• ACRIC: Securing Legacy Communication Networks via Authenticated Cyclic Redundancy Integrity Check [98.34702864029796]
  Recent security incidents in safety-critical industries exposed how the lack of proper message authentication enables attackers to inject malicious commands or alter system behavior.<n>These shortcomings have prompted new regulations that emphasize the pressing need to strengthen cybersecurity.<n>We introduce ACRIC, a message authentication solution to secure legacy industrial communications.
  arXiv  Detail & Related papers  (2024-11-21T18:26:05Z)
• A Survey and Comparative Analysis of Security Properties of CAN Authentication Protocols [92.81385447582882]
  The Controller Area Network (CAN) bus leaves in-vehicle communications inherently non-secure. This paper reviews and compares the 15 most prominent authentication protocols for the CAN bus. We evaluate protocols based on essential operational criteria that contribute to ease of implementation.
  arXiv  Detail & Related papers  (2024-01-19T14:52:04Z)
• The Impact of Exposed Passwords on Honeyword Efficacy [14.697588929837282]
  Honeywords are decoy passwords that can be added to a credential database. If a login attempt uses a honeyword, this indicates that the site's credential database has been leaked.
  arXiv  Detail & Related papers  (2023-09-19T05:10:02Z)
• Exploring Security Practices in Infrastructure as Code: An Empirical Study [54.669404064111795]
  Cloud computing has become popular thanks to the widespread use of Infrastructure as Code (IaC) tools. scripting process does not automatically prevent practitioners from introducing misconfigurations, vulnerabilities, or privacy risks. Ensuring security relies on practitioners understanding and the adoption of explicit policies, guidelines, or best practices.
  arXiv  Detail & Related papers  (2023-08-07T23:43:32Z)
• Provable Safe Reinforcement Learning with Binary Feedback [62.257383728544006]
  We consider the problem of provable safe RL when given access to an offline oracle providing binary feedback on the safety of state, action pairs. We provide a novel meta algorithm, SABRE, which can be applied to any MDP setting given access to a blackbox PAC RL algorithm for that setting.
  arXiv  Detail & Related papers  (2022-10-26T05:37:51Z)
• On Deep Learning in Password Guessing, a Survey [4.1499725848998965]
  This paper compares various deep learning-based password guessing approaches that do not require domain knowledge or assumptions about users' password structures and combinations. We propose a promising research experimental design on using variations of IWGAN on password guessing under non-targeted offline attacks.
  arXiv  Detail & Related papers  (2022-08-22T15:48:35Z)
• Targeted Honeyword Generation with Language Models [5.165256397719443]
  Honeywords are fictitious passwords inserted into databases to identify password breaches. Major difficulty is how to produce honeywords that are difficult to distinguish from real passwords.
  arXiv  Detail & Related papers  (2022-08-15T00:06:29Z)
• Certifiers Make Neural Networks Vulnerable to Availability Attacks [70.69104148250614]
  We show for the first time that fallback strategies can be deliberately triggered by an adversary. In addition to naturally occurring abstains for some inputs and perturbations, the adversary can use training-time attacks to deliberately trigger the fallback. We design two novel availability attacks, which show the practical relevance of these threats.
  arXiv  Detail & Related papers  (2021-08-25T15:49:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.