{"id":"https://openalex.org/W7155363219","doi":"https://doi.org/10.1109/tifs.2026.3687032","title":"On the Insecurity of Internally Sampled Honeyword Schemes","display_name":"On the Insecurity of Internally Sampled Honeyword Schemes","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7155363219","doi":"https://doi.org/10.1109/tifs.2026.3687032"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2026.3687032","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3687032","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037414803","display_name":"D Y Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I136765683","display_name":"Tianjin University of Technology","ror":"https://ror.org/00zbe0w13","country_code":"CN","type":"education","lineage":["https://openalex.org/I136765683"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ding Wang","raw_affiliation_strings":["College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-1667-2237","affiliations":[{"raw_affiliation_string":"College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I136765683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113767519","display_name":"Tingwei Fan","orcid":null},"institutions":[{"id":"https://openalex.org/I136765683","display_name":"Tianjin University of Technology","ror":"https://ror.org/00zbe0w13","country_code":"CN","type":"education","lineage":["https://openalex.org/I136765683"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tingwei Fan","raw_affiliation_strings":["College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0009-0003-8124-2406","affiliations":[{"raw_affiliation_string":"College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I136765683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134418787","display_name":"Fei Duan","orcid":null},"institutions":[{"id":"https://openalex.org/I136765683","display_name":"Tianjin University of Technology","ror":"https://ror.org/00zbe0w13","country_code":"CN","type":"education","lineage":["https://openalex.org/I136765683"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fei Duan","raw_affiliation_strings":["College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I136765683"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5037591282","display_name":"Zhenduo Hou","orcid":"https://orcid.org/0000-0002-7383-8379"},"institutions":[{"id":"https://openalex.org/I136765683","display_name":"Tianjin University of Technology","ror":"https://ror.org/00zbe0w13","country_code":"CN","type":"education","lineage":["https://openalex.org/I136765683"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhenduo Hou","raw_affiliation_strings":["College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-7383-8379","affiliations":[{"raw_affiliation_string":"College of Cryptology and Cyber Science, the Key Laboratory of Data and Intelligent System Security (Ministry of Education), and Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I136765683"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I136765683"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.47320708,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"21","issue":null,"first_page":"4594","last_page":"4609"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.1589999943971634,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.1589999943971634,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.10840000212192535,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.0502999983727932,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/government","display_name":"Government (linguistics)","score":0.2535000145435333},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.25049999356269836},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.249099999666214},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.2451000064611435},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.24300000071525574}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6054999828338623},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.26330000162124634},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.2535000145435333},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.25049999356269836},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.249099999666214},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2451000064611435},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.24300000071525574},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.23970000445842743},{"id":"https://openalex.org/C32283439","wikidata":"https://www.wikidata.org/wiki/Q1407014","display_name":"Radar tracker","level":3,"score":0.23919999599456787},{"id":"https://openalex.org/C149782125","wikidata":"https://www.wikidata.org/wiki/Q160039","display_name":"Econometrics","level":1,"score":0.22849999368190765}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2026.3687032","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3687032","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6401220598","display_name":null,"funder_award_id":"62222208","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6447616999","display_name":null,"funder_award_id":"62572259","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G978681150","display_name":null,"funder_award_id":"25JCJQJC00230","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Honeywords":[0],"are":[1,49,170,240],"plausible-looking":[2],"decoy":[3],"passwords":[4,70,202,227],"associated":[5,171],"with":[6,152,172,180,203],"each":[7,151,173],"user\u2019s":[8],"real":[9,201,226,249],"password":[10,14,238],"to":[11,51,138],"timely":[12],"detect":[13],"leakage.":[15],"The":[16],"more":[17,23,216],"indistinguishable":[18],"the":[19,22,42,53,125,186,211,242,254,264],"honeywords":[20,35,66],"are,":[21],"secure":[24],"a":[25,103],"honeyword":[26,30,62,92,112,207,232,272],"scheme":[27],"is.":[28],"However,":[29],"schemes":[31,63],"that":[32,64],"externally":[33],"generate":[34],"can":[36,191,196,219],"only":[37,181],"approximate,":[38],"but":[39],"not":[40],"equate,":[41],"distribution":[43],"of":[44,127,199,224,248,256,269],"user-chosen":[45],"passwords,":[46],"so":[47],"they":[48],"unlikely":[50],"achieve":[52],"ideal":[54,212],"indistinguishability.":[55],"To":[56,122],"address":[57],"this":[58,75,261],"issue,":[59],"internally":[60,90,110,270],"sampled":[61,91,111,271],"sample":[65],"from":[67],"other":[68],"users\u2019":[69,160],"have":[71],"been":[72],"proposed.":[73],"In":[74,259],"work,":[76],"we":[77,130],"first":[78],"reveal":[79],"two":[80,84],"critical":[81,85],"security":[82,126],"and":[83,97,114,120,133,143,159,194,222],"usability":[86],"flaws":[87],"in":[88,228],"existing":[89],"schemes,":[93,113],"i.e.,":[94],"Honeyindex":[95,119],"(TDSC\u201916)":[96],"Superword":[98],"(COSE\u201921).":[99],"We":[100,251],"then":[101],"formalize":[102],"<italic":[104,265],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[105,205,230,266],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">generic</i>":[106],"framework":[107],"for":[108,117],"sound":[109],"propose":[115,131],"variants":[116],"both":[118],"Superword.":[121],"principally":[123],"evaluate":[124,144],"our":[128],"framework,":[129],"Bayesian":[132],"intersection":[134,243],"attack":[135,244],"theories":[136],"leading":[137],"attackers\u2019":[139],"optimal":[140],"distinguishing":[141],"strategies,":[142],"them":[145],"under":[146],"three":[147],"major":[148],"attacker":[149],"models":[150],"varied":[153],"capabilities":[154],"(e.g.,":[155],"using":[156],"leaked":[157],"datasets":[158],"personal":[161],"information).":[162],"Evaluation":[163],"results":[164],"show":[165],"that,":[166],"when":[167],"40":[168],"sweetwords":[169],"user":[174],"(as":[175],"recommended":[176],"at":[177],"IEEE":[178],"S&P\u201922),":[179],"one":[182],"guess":[183],"per":[184],"account,":[185],"basic":[187],"attacker\u2019s":[188],"success":[189],"rate":[190],"reach":[192],"3.82%\u223c4.12%,":[193],"she":[195],"identify":[197,220],"4.31%\u223c5.04%":[198],"all":[200,225],"10<sup":[204,229],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">4</sup>":[206,231],"login":[208,233],"attempts,":[209,234],"breaking":[210],"2.50%(=1/40)":[213],"security.":[214],"Two":[215],"advanced":[217],"attackers":[218],"18.6%\u223c44.8%":[221],"20.6%\u223c43.6%":[223],"respectively.":[235],"When":[236],"multiple":[237],"files":[239],"available,":[241],"alone":[245],"identifies":[246],"18.3%\u223c18.6%":[247],"passwords.":[250],"also":[252],"explore":[253],"impacts":[255],"denial-of-service":[257],"attacks.":[258],"all,":[260],"work":[262],"reveals":[263],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">inherent</i>":[267],"insecurity":[268],"schemes.":[273]},"counts_by_year":[],"updated_date":"2026-05-08T13:12:06.581006","created_date":"2026-04-24T00:00:00"}