Take-a-tail honeyword generation demonstartion. Python program

Take-a-tale - honeyword generation technique, where a tail is added to the password. A number of passwords with same body, but with different tails are created (Juels and Rivest, 2013).

  
(Author's work)

I have decided to research this technique further and to write a python program that demonstrates how it works and how honeywords are supposed to work in general. The file take_a_tail.py is available for everyone on my google drive: link

I have also written a .bat file which starts a program and writes basic information about it:

User can enter 4 commands:
register - to register a new user in a system
login - to try to log in into the system
attack - prints a list of user with passwords
stop - stops program

First of all we need to register a new user:

After entering a new username and a password, user is asked to add 3 numbers after password. This 3 numbers are a tail. After registration his username and password are contained in memory with additional 5 honeywords - decoy passwords.

If we want to create a user with same username - program will not let us do it:

Let's create another user with the username - david, and password david654:

Now we have to usernames contained alongwith 6 different passwords, 5 from which are decoy passwords - honeywords

If user needs to log in, he needs to enter credentials:

However, let's imagine that adversary got into the host pc and had stolen the file with usernames and passwords. It can be simulated with entering attack command:

Passwords of all users were cracked and adversary now has a list of usernames with 6 possible passwords.

If user tries to log in with incorrect password, which is not one of honeywords, he will not get access and offered to try again:

However, if adversary tries to log in and enters one of the decoy passwords cracked, it triggers alarm:

Conclusion:

Program presented demonstrates how honeywords work and one of the possible honeyword generation techniques - take a tail technique. Moreover, it demonstrates one of the main problems of honeywords - possibility of Ddos attacks, since if adversary gets access to the file with passwords, she can enter them in order to execute security protocols and to put a strain on a targeted system. Nevertheless, this post gives a solid understanding of the idea of honeywords.

Reference:

Juels, A. and Rivest, R.L. (2013) ‘Honeywords: making password-cracking detectable’, in. CCS, Berlin, Germany: ACM, pp. 145–160. Available from: https://dl.acm.org/doi/abs/10.1145/2508859.2516671?casa_token=z0BT8j2R23UAAAAA:rWbGmGVWkVHKWKFF4USMBi0I8uIyQqJtHioVEPnIGUqiPR4nPE-jmn665OBxEUVr3UrzZfDo7isQ#sec-ref.