Text-based passwords remain the dominant form of authentication despite the growing adoption of alternative security mechanisms. As users accumulate multiple online accounts, convenience often leads to weak password practices such as reuse and the inclusion of personal information. This paper investigates the application of large language models (LLMs) to predict user passwords by leveraging personal attributes inferred from email addresses—such as name, nationality, gender, and year of birth. Using known breached credential datasets, we fine-tuned Google’s T5, Meta’s LLaMA, and BART models to generate targeted password guesses and evaluated their performance across different combinations of input features. Our findings show that incorporating personal attributes significantly improves guessing accuracy, with the T5 model achieving a success rate of 54.45% when provided with email address, name, nationality, and year of birth.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Targeted AI-Based Password Guessing Leveraging Email-Derived User Attributes

  • Karolina Jabłońska,
  • Emmanouil Vasilomanolakis

摘要

Text-based passwords remain the dominant form of authentication despite the growing adoption of alternative security mechanisms. As users accumulate multiple online accounts, convenience often leads to weak password practices such as reuse and the inclusion of personal information. This paper investigates the application of large language models (LLMs) to predict user passwords by leveraging personal attributes inferred from email addresses—such as name, nationality, gender, and year of birth. Using known breached credential datasets, we fine-tuned Google’s T5, Meta’s LLaMA, and BART models to generate targeted password guesses and evaluated their performance across different combinations of input features. Our findings show that incorporating personal attributes significantly improves guessing accuracy, with the T5 model achieving a success rate of 54.45% when provided with email address, name, nationality, and year of birth.