Popularity is everything: a new approach to protecting passwords from statistical-guessing attacks

摘要: We propose to strengthen user-selected passwords against statistical-guessing attacks by allowing users of Internet-scale systems choose any password they want--so long as it's not already too popular with other users. create an oracle identify undesirably using existing data structure known a count-min sketch, which we populate users' and update each new user password. Unlike most applications probabilistic structures, seek achieve only maximum acceptable rate false-positives, set minimum false-positive confound attackers who might query the or even obtain copy it.