Decoy passwords, or ``honeywords,'' alert a site to its breach if entered in a login attempt on that site. However, an attacker can identify a user-chosen password from among the decoys, without alerting the site to its breach, via credential stuffing, i.e., entering the stolen passwords at another site where a user reused her password. Prior work thus proposed that sites monitor for the entry of their honeywords at other sites, but the incentives for sites to participate in this monitoring remain unclear. In this paper, we propose and evaluate an algorithm by which sites can exchange monitoring favors. Through a model-checking analysis, we show that a site can improve its ability to detect its own breach when it increases the monitoring effort it expends for others. We quantify how key parameters impact detection effectiveness and their implications for deploying a monitoring ecosystem. Finally, we evaluate our algorithm on a breached credential dataset, demonstrating effectiveness at scale.

翻译：蜜词（即“honeywords”）是一种诱饵密码，若在某站点登录尝试时被输入，则会向该站点发出泄露警报。然而，攻击者可通过凭证填充攻击（即利用用户在另一站点重复使用的密码进行登录）从蜜词中识别出用户真实选择的密码，而不会触发站点泄露警报。先前研究提出站点应监控其他站点中自身蜜词被输入的情况，但站点参与此类监控的激励机制仍不明确。本文提出并评估了一种允许站点间交换监控支持（monitoring favors）的算法。通过模型检验分析，我们证明当站点增加为他人付出的监控努力时，其自身泄露检测能力将得到提升。我们量化了关键参数对检测效果的影响，并探讨了部署监控生态系统的相关启示。最后，我们基于泄露凭证数据集对算法进行评估，验证了其在大规模场景下的有效性。