Understanding digit‐only financial account passwords: ID card, structure, and security

International Journal of Intelligent SystemsEarly View RESEARCH ARTICLE Understanding digit-only financial account passwords: ID card, structure, and security Hongfang Shi, Hongfang Shi orcid.org/0000-0002-5385-4013 Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorWenying Zhang, Corresponding Author Wenying Zhang zhangwenying@sdnu.edu.cn Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, China Correspondence Wenying Zhang, School of Information Science and Engineering, Shandong Normal University, Wencong Building, No.1, Daxue Rd. Jinan 250358, China. Email: zhangwenying@sdnu.edu.cnSearch for more papers by this authorZimin Zhang, Zimin Zhang Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorDewen Ding, Dewen Ding Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorHuimin Liu, Huimin Liu Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorHong Lei, Hong Lei Department of Mathmatics, Dongying Vocational College, Donngying, ChinaSearch for more papers by this author Hongfang Shi, Hongfang Shi orcid.org/0000-0002-5385-4013 Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorWenying Zhang, Corresponding Author Wenying Zhang zhangwenying@sdnu.edu.cn Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, China Correspondence Wenying Zhang, School of Information Science and Engineering, Shandong Normal University, Wencong Building, No.1, Daxue Rd. Jinan 250358, China. Email: zhangwenying@sdnu.edu.cnSearch for more papers by this authorZimin Zhang, Zimin Zhang Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorDewen Ding, Dewen Ding Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorHuimin Liu, Huimin Liu Department of Cybersecurity, School of Information Science and Engineering, Shandong Normal University, Jinan, ChinaSearch for more papers by this authorHong Lei, Hong Lei Department of Mathmatics, Dongying Vocational College, Donngying, ChinaSearch for more papers by this author First published: 11 July 2022 https://doi.org/10.1002/int.22959Read the full textAboutPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Password-based authentication is widely used in website access. Current studies on password security have focused considerable attention on letter-only passwords or passwords that include both letters and digits. However, little research has been conducted on commercial and digit-only passwords. In this paper, we comprehensively evaluate digit-only passwords by analyzing approximately 130,000 passwords from the 12306 data set. We observe that approximately 20% of six-digit passwords belonging to Chinese users include the user's identity document (ID) card information. Most of the passwords are found to be related to the user's birth dates. Additionally, we demonstrate that male users are more likely to set passwords with digits extracted from their ID card numbers than female users. It is the first time that the relation between real-user passwords and ID card series numbers was considered. It focuses on actual attack methodologies and real-user passwords, which renders this study an explicit study on digit-only password security. We propose a password-encryption authentication model based on FF3-1 to implement secure storage of passwords. We experiment with ciphertext and plaintext passwords using three–three and four–two structures combined with probabilistic context-free grammars. The cracking success rates of ciphertext passwords are found to be 0.086% and 1.06%, and they can recover 59.83% and 33.2% of the passwords in the test set. Conversely, using plaintext passwords results in the recovery of 98% and 85% of passwords in the test set. Our results demonstrate that the use of encryption for password storage can significantly reduce the cracking success rate of attackers. Early ViewOnline Version of Record before inclusion in an issue RelatedInformation