Targeted AI-Based Password Guessing Leveraging Email-Derived User Attributes
摘要
Text-based passwords remain the dominant form of authentication despite the growing adoption of alternative security mechanisms. As users accumulate multiple online accounts, convenience often leads to weak password practices such as reuse and the inclusion of personal information. This paper investigates the application of large language models (LLMs) to predict user passwords by leveraging personal attributes inferred from email addresses—such as name, nationality, gender, and year of birth. Using known breached credential datasets, we fine-tuned Google’s T5, Meta’s LLaMA, and BART models to generate targeted password guesses and evaluated their performance across different combinations of input features. Our findings show that incorporating personal attributes significantly improves guessing accuracy, with the T5 model achieving a success rate of 54.45% when provided with email address, name, nationality, and year of birth.