Password guessing is a primary method for password strength evaluation. Despite various password guessing models have been proposed, there is still a significant gap between their guessing effectiveness and the actual cracking capabilities of attackers. Integrating multiple models for password guessing, also known as hybrid password guessing, could better capture the cracking capabilities of real attackers. However, the reason why hybrid password guessing can enhance cracking capabilities, and how to effectively integrate multiple heterogeneous password guessing models, are still not well understood. To address these issues, this paper draws inspiration from the concept of multi-view learning. We regard the guess lists generated by various password guessing models as multiple views of the data. Through a comprehensive analysis of these guess lists, we have identified the key reason why hybrid password guessing can enhance the cracking capabilities: integrating more diverse views allows for the coverage of a wider range of heterogeneous password characteristics, and provides more detailed information on effective password distributions. Based on the these findings, we propose a new hybrid password guessing framework, named GuessFuse . GuessFuse employs the multi-view subset extraction module and segment splitting selection module to accurately extract and reorganize the effective password from multiple guess lists. Experimental results on six large-scale datasets demonstrate the effectiveness of GuessFuse . By combining two (resp. five) guess lists, GuessFuse outperforms its foremost counterparts by an average of 11.00% ~ 59.62% (resp. 4.70% ~ 17.66%) within 10 ⁷ guesses. GuessFuse can effectively improve the cracking success rate under a limited number of guesses, approaching the actual cracking capabilities of attackers.

Internationalized Domain Names (IDNs) allow users to access the internet using domain names in their native languages. This technology provides significant convenience for non-English speaking users. However, despite the widespread acceptance and use of IDNs, the risks associated with using IDNs remain unclear in practice, such as the IDN homograph problem. To address this issue, we conduct a systematic analysis of the IDN homograph problem and explore the adoption characteristics of IDNs in practice. Specifically, we design and implement an effective IDN analysis framework, named as IDNMon. We perform a large-scale measurement study covering 863 top-level domain zone files and historical top lists based on IDNMon. Our findings indicate that the IDN registration and usage in Europe exceeds that in East Asia. Our results confirm that the IDN homograph problem is universal (12.32% of 2,623,161 IDNs face this problem), which raises serious challenges when designing protection strategies for browsers. Our work provides new insights into the adoption of IDNs in practice, contributes to a better understanding, and promotes the development of IDNs.

Password guessing is a crucial research direction in password security, considering vulnerabilities like password reuse and data breaches. While research has extensively explored intra-site password guessing, the complexities of cross-site attacks, where attackers use leaked data from one site to target another, remain less understood. This study investigates the impact of dataset feature similarity on cross-site password guessing performance, revealing that dataset differences significantly influence guessing success more than model variations. By analyzing eight password datasets and four guessing methods, we identified eight key features affecting guessing success, including general data features like length distribution and specific semantic features like PCFG grammar. Our research reveals that syntactic and statistical patterns in passwords, particularly PCFG features, are most effective for cross-site password guessing due to their strong generalization across datasets. The Spearman correlation coefficient of 0.754 between PCFG feature similarity and guessing success rate indicates a significant positive correlation, unlike the minimal impact of length distribution features (0.284). These findings highlight the importance of focusing on robust semantic features like PCFG for improving password guessing techniques and security strategies. Additionally, the study underscores the importance of dataset selection for attackers and suggests that defenders can enhance security by mitigating feature similarity with commonly leaked data.

Password has become the mainstream method of authentication today. To improve password security, researchers evaluate the strength of target password datasets through early brute-force attacks to current password guessing methods, aiming to help users reduce the use of weak passwords. With users becoming more aware of security, they make local variations on weak passwords to improve the password strength while being easy to remember. These transformations render passwords more complex and enhance the score in password strength meter. However, such variations do not genuinely enhance password security, as human habits tend to converge. This allows attackers to deduce the modification patterns and consequently crack these passwords. Motivated by this, this paper defines the hidden weak passwords, a local variant of explicit weak passwords, which appear to enhance password security yet remain vulnerable. We systematically analyze transformation behavior between explicit and hidden weak passwords. Then we design an automated rule generation algorithm to identify hidden weak passwords and generate transformation rules. Based on automatically mined rules, we generate a large number of password guesses and fuses them with existing methods to improve password guessing performance. Finally, we demonstrate the effectiveness of the proposed method through password guessing experiments on eight real-world datasets, where the cracking rate improves on all five state-of-the-art methods.