性别对口令安全性的影响

邹云开; 汪定

doi:10.11999/JEIT261036

性别对口令安全性的影响

doi: 10.11999/JEIT261036 cstr: 32379.14.JEIT261036

邹云开,
汪定^,

1.
南开大学密码与网络空间安全学院天津 300350
2.
天津市网络与数据安全技术重点实验室天津 300350
3.
数据与智能系统安全教育部重点实验室天津 300350

基金项目: 国家自然科学基金项目(62502238, 62572259)，中国博士后科学基金资助项目(2025M771596)，天津市自然科学基金青年项目(25JCJQJC00230)

详细信息

作者简介:
邹云开：男，助理研究员，研究方向为口令安全。邮箱：　zouyunkai@nankai.edu.cn

汪定：男，教授，博士生导师，研究方向为口令安全、抗量子密码协议。邮箱：　wangding@nankai.edu.cn

通讯作者:
汪定　wangding@nankai.edu.cn

中图分类号: TN918.2
计量
- 文章访问数: 19
- HTML全文浏览量: 3
- PDF下载量: 0
- 被引次数: 0
出版历程
- 收稿日期: 2026-07-27
- 修回日期: 2026-09-23
- 录用日期: 2026-11-05
- 网络出版日期: 2026-11-14

The Impact of Gender on Password Security

ZOU Yunkai,
WANG Ding^,

1.
College of Cryptology and Cyber Science, Nankai University, Tianjin 300350, China
2.
Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin 300350, China
3.
Key Laboratory of Data and Intelligent System Security, Ministry of Education, Tianjin 300350, China

Funds: The National Natural Science Foundation of China (62502238 and 62572259), The China Postdoctoral Science Foundation under Grant (2025M771596), The Tianjin Natural Science Foundation Project (25JCJQJC00230)

摘要

摘要: 口令是人类可记忆的短密钥，被广泛应用于数据加密、数字签名、密钥协商和秘密共享等密码学场景。已有研究主要关注姓名、生日等显式个人信息对口令安全性的影响，而性别等隐式个人信息与真实口令构造行为之间的关联仍缺乏系统研究。本文基于8个大规模真实口令数据集，从口令分布、长度、个人信息使用、流行特性、字符组成、结构和语义特征7个维度分析不同性别用户的口令构造差异，并进一步研究口令重用过程中的性别相关行为模式。研究发现，男性和女性用户口令集合的Jaccard相似度仅为0.86%～4.85%，但两类用户口令频率分布均可由参数接近的基于累积分布函数的Zipf(CDF-Zipf)模型有效刻画；在两个通过邮箱关联构建的口令对数据集中，男性用户的口令对更常呈现局部相似与内容重叠特征，而女性用户的口令对中具有相同结构的比例更高。在此基础上，本文提出一种融合性别信息的口令猜测排序优化方法。实验结果表明，改进的概率上下文无关文法(PCFG)模型在10⁴猜测数下，猜测成功率较原始模型提升2.86%～9.09%(平均5.17%)；面向猜测数受限的在线猜测场景(如每个账户猜测10次)，改进的口令重用模型G-TarGuess-II对女性用户的猜测成功率提升3.54%～8.91%(平均6.22%)。
- 口令安全 /
- 隐式个人信息 /
- 口令重用 /
- 性别差异
Abstract: Objective Passwords are short, human-memorable secrets widely used in identity authentication and cryptographic applications. Existing research has largely focused on explicit personally identifiable information (PII), such as names and birthdays, whereas the relationship between implicit PII, particularly gender, and password construction remains insufficiently understood. This study examines gender-related differences in password characteristics and cross-site reuse behaviors, and evaluates whether incorporating gender information improves password guessing. Methods The study uses approximately 35.51 million real-world password records from eight websites, comprising four Chinese and four English services (Table 1). Gender-related analyses are based on records with directly available or email-linked gender information. Password characteristics are analyzed along seven dimensions: frequency distribution, length, PII usage, popularity, character composition, structure, and semantics. Parameters of the cumulative distribution function-based Zipf (CDF-Zipf) model are estimated by comparing empirical rank-based cumulative frequency curves with those obtained from simulated samples of the same size. Each fitted model is evaluated using 30 independent simulations. Equal-size sampling within website-by-gender strata balances website contributions to pooled comparisons. Email-linked password pairs associated with Promo and Zoosk are analyzed using normalization rules, edit distance, content overlap, and character-type structures. A gender-conditioned likelihood-ratio framework is developed to rerank existing guesses. For the probabilistic context-free grammar (PCFG) model, structural prior probabilities are calibrated while character-segment probabilities remain unchanged. Sharing segment dictionaries preserves information from pooled training data and helps mitigate the sparsity associated with training separate generative models for each gender. G-TarGuess-II augments TarGuess-II with gender-conditioned lexical features derived from complete passwords, case-normalized forms, initial and final character blocks, and character n-grams. For each account, the same 100 baseline guesses are reranked. Evaluation focuses on pairs with different known and target passwords (at 10 guesses per account). Password-pair datasets are partitioned by email identifier, parameters are selected using validation data, and paired guessing outcomes are assessed using two-sided exact McNemar tests with Holm correction. Sensitivity analyses examine simulated email mismatches and gender-label perturbations. Results and Discussions Across websites, Jaccard similarities between male and female users’ password sets range from 0.86% to 4.85% (Table 2). Despite this limited overlap, both groups show similarly skewed, long-tailed frequency distributions, well characterized by CDF-Zipf models with gender-specific exponent estimates differing by at most 0.052 within each website (Fig. 1). For each of the 16 gender-specific subsets, the maximum absolute discrepancy between the empirical and simulated cumulative frequency curves is averaged over 30 simulations. These averages range from 0.29 to 2.62 percentage points, with an overall mean of 0.98 percentage points. Passwords longer than 10 characters are more prevalent among female users in the Chinese datasets, whereas the proportions are slightly higher among male users in the English datasets (Table 3). Passwords containing at least one PII type account for 34.82%-51.36% of passwords in the four Chinese datasets and approximately 20% in ClixSense and QNB. PII match rates are higher among male users in 12306, Dodonew, and CSDN, whereas WuxiHR shows the opposite trend (Table 4). In the balanced structural comparison, digits constitute more than half of the characters in 48.26% of male users’ passwords and 43.90% of female users’ passwords (Table 6). In the balanced English-language samples, 17.16% of female users’ passwords and 11.92% of male users’ passwords contain terms from at least one predefined semantic category (Table 7). Among users whose passwords matched at least one predefined semantic category, female users were more likely to use passwords containing terms from the relationship and identity categories, whereas male users were more likely to use passwords containing terms from the emotion and interest categories (Table 7). In both email-linked password-pair datasets, male users’ pairs show higher rates of local similarity and content overlap, whereas female users’ pairs more frequently share the same character-type sequence and segment lengths (Tables 10 and 11). At 10⁴ guesses, gender-conditioned PCFG improves guessing success rates across eight websites, with relative improvements of 2.86%-9.09%, averaging 5.17% (Table 13). The newly guessed passwords in CSDN and WuxiHR were predominantly eight-digit and six-digit numeric strings, respectively (94.12% and 80.00%), whereas alphabetic strings accounted for 89.66% of the additional passwords successfully guessed for female users in ClixSense and Promo combined. Pooled relative improvements across websites are 3.36% for male users and 6.80% for female users; both are statistically significant after Holm correction. At 10 guesses per account, G-TarGuess-II achieves relative improvements of 3.54% on Promo and 8.91% on Zoosk for female users. These improvements are statistically significant, whereas the corresponding gains of 0.20% and 0.72% for male users are not (Table 14). Additional successful guesses arise from moving correct guesses from baseline ranks 11–100 into the top 10, without increasing dictionary size. Among the additional passwords successfully guessed for female users, 91.57% are formed by appending a single digit to the known password. Reversing the roles of the known and target passwords preserves positive overall gains and larger relative improvements for female users. Simulated email mismatches and gender-label perturbations generally preserve the directions of the principal descriptive differences, although their magnitudes may decrease. Conclusions Gender information can improve password guessing by reranking existing guesses. The gains depend on language, service context, the baseline model, and the allowed guess number. These findings support using gender as an auxiliary factor in password security evaluation, but do not indicate that either gender consistently chooses stronger passwords. Practical defenses should address the use of personal information and simple modifications of existing passwords while limiting the collection of sensitive user attributes. Future work could combine user studies with analyses of more diverse datasets to investigate motivations behind password construction and reuse, and assess the generalizability of the observed gender-related differences.
- Password security /
- Implicit personal information /
- Password reuse /
- Gender differences

HTML全文

图 1 男女口令经验累计频数分布与CDF-Zipf模型模拟结果

下载: 全尺寸图片幻灯片

图 2 关联样本与对照样本主要特征对比

下载: 全尺寸图片幻灯片

表 1 本文所使用口令数据集的基本信息†

数据集	网站类型	语言	泄露时间	原始记录数	有效口令数	独立口令数	个人信息
Dodonew	电子商务	中文	2011.12	16,282,279	16,235,536	10,111,831	电子邮箱
CSDN	程序员社区	中文	2011.12	6,428,410	6,428,277	4,037,605	电子邮箱
COMB	混合数据	混合	2021.02	3,279,064,312	—	—	电子邮箱
WuxiHR	人才招聘	中文	2017.02	73,816	73,811	61,944	姓名、用户名、电子邮箱、生日、性别、电话号码
12306	铁路客运	中文	2014.12	129,303	129,303	117,808	姓名、用户名、电子邮箱、出生日期、手机号、身份证号
ClixSense	在线任务平台	英文	2016.09	2,222,045	2,222,045	1,628,471	姓名、用户名、电子邮箱、出生日期、性别
QNB	网上银行	英文	2016.04	92,212	92,183	75,193	姓名、用户名、电子邮箱、出生日期、性别、电话号码等
Zoosk	在线交友	英文	2020.01	29,186,508	—	—	电子邮箱、性别
Promo	视频平台	英文	2020.07	22,086,745	—	—	电子邮箱、性别
†“有效口令数”指经过本文清洗规则后保留的记录数，“独立口令数”指去重后的口令数量。经邮箱与COMB(Compilation Of Many Breaches)数据集关联后，Zoosk和Promo分别获得8,326,265条和2,003,656条关联记录。COMB为混合数据集，未单独统计有效和独立口令数。

下载: 导出CSV

表 2 本文所使用口令数据集的基本信息(性别相关)

数据集	男性口令数量	女性口令数量	男性独立口令数(占比)	女性独立口令数(占比)	Jaccard相似度(%)†
12306	119,293	9,747	109,249(91.58%)	9,365(96.08%)	0.87
Dodonew	105,514	15,731	97,944(92.83%)	14,878(94.58%)	0.86
CSDN	66,145	11,269	54,598(82.54%)	9,729(86.33%)	1.49
WuxiHR	32,664	26,859	28,493(87.23%)	23,935(89.11%)	2.63
ClixSense	1,571,910	635,551	1,186,195(75.46%)	499,083(78.53%)	4.17
QNB	66,581	24,364	55,047(82.68%)	20,272(83.20%)	1.57
Zoosk	5,138,019	3,186,278	3,788,371(73.73%)	2,318,024(72.75%)	4.85
Promo	736,919	1,266,196	655,291(88.92%)	1,081,553(85.42%)	3.10
†Jaccard相似度定义为男女用户独立口令集合交集与并集之比；Zoosk与Promo统计成功完成邮箱匹配和性别确定的口令记录。

下载: 导出CSV

表 3 男女用户口令长度分布(表中数字均为百分比%；M表示男性，F表示女性；表4同)

数据集	1-10		11		12		13		14		15		>15
数据集	M	F	M	F	M	F	M	F	M	F	M	F	M	F
12306	94.25	92.06	3.39	4.02	1.45	2.28	0.51	0.98	0.29	0.50	0.12	0.15	0.00	0.00
Dodonew	95.66	92.62	2.58	4.23	0.98	1.61	0.41	0.72	0.24	0.48	0.11	0.20	0.02	0.14
CSDN	83.44	78.38	7.18	8.64	4.57	5.99	1.87	2.64	1.66	2.47	0.83	1.22	0.45	0.66
WuxiHR	81.38	75.15	9.91	12.27	4.24	6.06	2.19	3.04	1.22	1.84	0.70	0.98	0.36	0.67
ClixSense	81.47	83.40	6.93	6.17	4.65	4.11	2.46	2.32	1.69	1.53	1.06	0.94	1.74	1.54
QNB	76.44	78.98	10.67	9.63	6.72	5.94	3.20	2.87	1.55	1.48	0.76	0.59	0.65	0.51
Promo	89.48	91.82	3.16	2.28	2.20	1.59	1.22	0.92	0.79	0.60	2.00	2.17	1.15	0.62
Zoosk	90.79	91.44	3.46	3.02	2.21	1.96	1.17	1.09	0.72	0.66	1.13	1.42	0.52	0.40

下载: 导出CSV

表 4 男女用户口令个人信息使用情况对比(表中数字均为百分比%)^†

PII	12306		Dodonew		CSDN		WuxiHR		ClixSense		QNB
PII	M	F	M	F	M	F	M	F	M	F	M	F
姓名	19.91	10.93	20.61	12.48	17.83	13.43	17.94	19.46	10.05	8.35	4.30	3.01
生日	16.71	12.46	14.31	12.18	16.80	17.30	15.43	21.02	6.66	6.65	1.73	1.93
邮箱	9.12	9.75	12.16	16.09	14.12	14.39	9.70	9.95	7.06	5.80	6.08	5.93
账户	18.12	16.72	11.61	5.58	3.10	0.86	24.16	23.95	8.45	7.17	9.81	10.43
电话号	0.82	0.78	0.85	1.26	1.26	1.39	3.92	4.42	—	—	3.36	4.14
至少包含一种PII	43.95	35.73	41.99	34.82	39.18	36.30	48.03	51.36	21.97	19.81	19.75	20.85
^†姓名信息先删除非字母数字字符并转为小写；姓名变型包括长度不少于3的单个姓名组成部分、名与姓顺序连接、姓与名逆序连接、名首字母加姓、名加姓首字母以及全部姓名组成部分的首字母串。生日信息采用YYYYMMDD、MMDDYYYY、DDMMYYYY、YYMMDD、MMDDYY、DDMMYY、YYYY、MMDD和DDMM共9种表示形式；电子邮箱取“@”前的用户名部分，账户名则使用规范化后的字符串，并提取其中长度不少于3的连续字母段或数字段；电话号码采用完整号码、前三位和后四位。若同一口令同时匹配多类PII，则分别计入相应类别；“至少包含一种PII”仅计数一次。

下载: 导出CSV

表 5 男女用户流行口令使用情况对比

	12306		CSDN		ClixSense		Promo
Rank	Male	Female	Male	Female	Male	Female	Male	Female
1	123456	123456	12345678	dearbook	123456	123456	123456	123456
2	a123456	a123456	123456789	12345678	123456789	iloveyou	123456789	123456789
3	5201314	123456a	dearbook	123456789	12345678	123456789	12345678	iloveyou
4	123456a	111111	11111111	11111111	111111	password	1234567	12345
5	111111	woaini1314	00000000	00000000	password	12345678	12345	12345678
6	woaini1314	1q2w3e4r	88888888	88888888	1234567	111111	1234567890	1234567
7	000000	5201314	1234567890	1234567890	qwerty	clixsense	123123	1234567890
8	123123	1qaz2wsx	123123123	123123123	abcdefg	1234567	111111	password
9	qq123456	qq123456	123456	66666666	clixsense	princess	password	justinbieb
10	1qaz2wsx	123123	iloveyou	1qaz2wsx	000000	sunshine	000000	111111
前10占比(%)	1.26	1.52	9.78	10.63	1.65	1.16	1.47	0.84

下载: 导出CSV

表 6 男女用户口令字符组成与结构特征差异(相对差异=(男性−女性)/女性×100%)

结构或字符指标(示例)	女性(%)	男性(%)	相对差异(%)
LD：字母段＋数字段(如abc123，结构为L3D3)	41.19	42.04	+2.06
D：纯数字(如123456，结构为D6)	22.70	24.54	+8.09
L：纯字母(如password，结构为L8)	18.66	16.61	−10.96
数字字符占多数(如abc12345，数字5个、字母3个)	43.90	48.26	+9.93
以数字结尾(如password123，末尾结构段为D3)	67.68	70.54	+4.23

下载: 导出CSV

表 7 口令语义类别的性别差异(总体占比与条件占比)^†

类别	女性总体(%)	男性总体(%)	女性条件(%)	男性条件(%)
情感类	2.614	2.219	15.234	18.625
关系类	0.931	0.369	5.423	3.100
兴趣类	1.083	1.219	6.314	10.233
身份类	14.425	9.061	84.070	76.037
^†总体占比以各性别的36,000条口令为分母；条件占比以包含至少一种语义类别的女性6,177条、男性4,290条口令为分母。

下载: 导出CSV

表 8 男女用户基于规范化变换的重用行为

数据集	规范化规则(示例)	女性(%)	男性(%)	相对差异(%)
Promo Zoosk	①忽略大小写相同(如Password123→password123) ②Leet规范化相同(如h3lloworld→helloworld) ③删除非字母数字字符相同(如hello_world→helloworld)	2.501 3.169	2.839 3.299	+13.5 +4.1

下载: 导出CSV

表 9 男女用户数字段修改行为

数据集	特征(示例)	女性(%)	男性(%)	相对差异(%)
Promo	数字前后缀变化(如123hello→hello456)	7.135	8.544	+19.8
	数字后缀变化(如hello123→hello456)	6.732	8.053	+19.6
	数字前缀变化(如123hello→456hello)	0.263	0.300	+13.7
	年份前后缀追加/删除(如hello2026→hello)	0.228	0.371	+62.4
Zoosk	数字前后缀变化(如2023love→love88)	13.114	13.604	+3.7
	数字后缀变化(如love123→love456)	12.434	12.899	+3.7
	数字前缀变化(如123love→456love)	0.470	0.471	+0.2
	年份前后缀追加/删除(如love→love2026)	0.314	0.435	+38.7

下载: 导出CSV

表 10 男女用户口令的编辑距离与相似度

数据集	特征	女性(%)	男性(%)	相对差异(%)
Promo	编辑距离≤1(如hello1→hello2)	7.790	9.497	+21.9
	编辑距离≤2(如hello12→hello34)	11.963	14.511	+21.3
	编辑距离≤3(如abc123→abc456)	13.870	17.120	+23.4
	编辑相似度≥80%(如passwor1→passwor2)	9.299	11.456	+23.2
Zoosk	编辑距离≤1(如love1→love!)	11.314	11.481	+1.5
	编辑距离≤2(如welcome→welxomex)	17.421	18.115	+4.0
	编辑距离≤3(如qwerty→qwarty1!)	19.855	21.110	+6.3
	编辑相似度≥80%(如sunshine1→sunshine2)	13.496	13.853	+2.6

下载: 导出CSV

表 11 男女用户的内容继承与结构保持行为

数据集	特征(示例)	女性(%)	男性(%)	相对差异(%)
Promo	子串包含(如password→password123)	12.809	16.270	+27.0
	公共前缀或后缀(如hello123→hello456)	16.487	20.774	+26.0
	相同结构(如love123!→girl456?，均为L4D3S1)	11.075	9.609	−13.2
Zoosk	子串包含(如sunshine→mysunshine)	17.221	18.476	+7.3
	公共前缀或后缀(如abc2024→xyz2024)	22.988	24.459	+6.4
	相同结构(如hello12→world34，均为L5D2)	9.080	8.648	−4.8

下载: 导出CSV

表 12 男女用户的互斥口令修改类型

修改类型(示例)	Promo女性(%)	Promo男性(%)	Zoosk女性(%)	Zoosk男性(%)
完全相同(如password123→password123)	0.978	1.532	0.356	0.301
仅大小写变化(如PassWord3→password3)	1.577	1.848	2.030	2.241
表面符号变化(如pass-word→pass_word)	0.845	0.809	0.949	0.750
数字段修改(如hello123→hello456)	7.135	8.544	13.114	13.604
Leet变化(如password→p@ssw0rd)	0.080	0.183	0.189	0.309
其他局部编辑(如password→passward)	2.858	3.984	3.061	3.887
内容继承(如sunshine→mysunshine!)	3.706	4.857	4.049	4.353
其他(如password123→qwerty!)	82.822	78.243	76.250	74.554

下载: 导出CSV

表 13 PCFG性别结构似然比重排结果(猜测数为10⁴)

数据集	训练数(男性)	训练数(女性)	原PCFG命中数(成功率)	改进PCFG命中数(成功率)	相对提升(%)
12306	100,000	6,747	343(8.575%)	367(9.175%)	7.00
CSDN	63,145	8,269	743(18.575%)	785(19.625%)	5.65
ClixSense	100,000	100,000	444(11.100%)	457(11.425%)	2.93
Dodonew	100,000	12,731	372(9.300%)	385(9.625%)	3.49
Promo	100,000	100,000	245(6.125%)	252(6.300%)	2.86
QNB	63,581	21,364	224(5.600%)	236(5.900%)	5.36
WuxiHR	29,664	23,859	540(13.500%)	567(14.175%)	5.00
Zoosk	100,000	100,000	341(8.525%)	372(9.300%)	9.09

下载: 导出CSV

表 14 G-TarGuess-II在10猜测数下的实验结果

数据集	性别	测试数	TarGuess-II命中数(成功率)	G-TarGuess-II命中数(成功率)	相对提升(%)	$ p $值
Promo	女性	6,931	396(5.71%)	410(5.92%)	+3.54	0.0198
Promo	男性	6,894	497(7.21%)	498(7.22%)	+0.20	1.0000
Zoosk	女性	6,977	651(9.33%)	709(10.16%)	+8.91	9.8×10⁻¹³
Zoosk	男性	6,980	694(9.94%)	699(10.01%)	+0.72	1.0000

下载: 导出CSV

参考文献(56)

[1]	BONNEAU J, HERLEY C, VAN OORSCHOT P C, et al. Passwords and the evolution of imperfect authentication[J]. Communications of the ACM, 2015, 58(7): 78–87. doi: 10.1145/2699390.
[2]	HA Guanxiong, JIA Chunfu, GE Xiaowei, et al. Efficient and anonymous password-hardened encryption services[J]. Information Sciences, 2024, 653: 119771. doi: 10.1016/j.ins.2023.119771.
[3]	DZIEMBOWSKI S, JARECKI S, KEDZIOR P, et al. Password-protected threshold signatures[C]. 30th International Conference on the Theory and Application of Cryptology and Information Security, Kolkata, India, 2024: 174–206. doi: 10.1007/978-981-96-0891-1_6.
[4]	舒琴, 王圣宝, 路凡义, 等. 基于理想格的通用可组合两方口令认证密钥交换协议[J]. 电子与信息学报, 2021, 43(6): 1756–1763. doi: 10.11999/JEIT191029. SHU Qin, WANG Shengbao, LU Fanyi, et al. Universally composable two-party password-based authenticated key exchange from ideal lattices[J]. Journal of Electronics & Information Technology, 2021, 43(6): 1756–1763. doi: 10.11999/JEIT191029.
[5]	朱留富, 汪定. 支持商密SM9算法框架的多因素认证方案[J]. 电子与信息学报, 2024, 46(5): 2137–2148. doi: 10.11999/JEIT231197. ZHU Liufu and WANG Ding. A multi-factor authentication scheme under the SM9 algorithm framework[J]. Journal of Electronics & Information Technology, 2024, 46(5): 2137–2148. doi: 10.11999/JEIT231197.
[6]	霍威, 王科, 唐俊, 等. 一种基于人体轮廓形变场的双流网络步态识别方法[J]. 电子与信息学报, 2024, 46(10): 4062–4071. doi: 10.11999/JEIT231025. HUO Wei, WANG Ke, TANG Jun, et al. A dual-stream network based on body contour deformation field for gait recognition[J]. Journal of Electronics & Information Technology, 2024, 46(10): 4062–4071. doi: 10.11999/JEIT231025.
[7]	杜兰, 李逸明, 薛世鲲, 等. 结合相似度预测和阈值自动求解的开集条件下毫米波雷达点云步态识别方法[J]. 电子与信息学报, 2025, 47(6): 1850–1863. doi: 10.11999/JEIT241034. DU Lan, LI Yiming, XUE Shikun, et al. Millimeter-wave radar point cloud gait recognition method under open-set conditions based on similarity prediction and automatic threshold estimation[J]. Journal of Electronics & Information Technology, 2025, 47(6): 1850–1863. doi: 10.11999/JEIT241034.
[8]	YADAV T K and SEAMONS K. A security and usability analysis of local attacks against FIDO2[C]. 2024 Network and Distributed System Security Symposium, San Diego, USA, 2024: 1–15. doi: 10.14722/ndss.2024.24327.
[9]	BONNEAU J, HERLEY C, VAN OORSCHOT P C, et al. The quest to replace passwords: A framework for comparative evaluation of web authentication schemes[C]. 2012 IEEE Symposium on Security and Privacy, San Francisco, USA, 2012: 553–567. doi: 10.1109/SP.2012.44.
[10]	王平, 汪定, 黄欣沂. 口令安全研究进展[J]. 计算机研究与发展, 2016, 53(10): 2173–2188. doi: 10.7544/issn1000–1239.2016.20160483. WANG Ping, WANG Ding, and HUANG Xinyi. Advances in password security[J]. Journal of Computer Research and Development, 2016, 53(10): 2173–2188. doi: 10.7544/issn1000–1239.2016.20160483.
[11]	汪定, 陈晓峰, 马建峰, 等. MIT Technology Review 2022年“全球十大突破性技术”解读[J]. 中国科学基金, 2022, 36(3): 432–446. WANG Ding, CHEN Xiaofeng, MA Jianfeng, et al. Interpretation of 2022 MIT technology review's Top10 breakthrough technologies[J]. Bulletin of National Natural Science Foundation of China, 2022, 36(3): 432–446.
[12]	Verizon Business. 2025 data breach investigations report[R/OL]. https://www.verizon.com/business/resources/T735/reports/2025-dbir-data-breach-investigations-report.pdf, 2025.
[13]	WINDER D. Act now: 48 million Gmail usernames and passwords leaked online[EB/OL]. https://www.forbes.com/sites/daveywinder/2026/01/25/48-million-gmail-usernames-and-passwords-leaked-online/, 2026.
[14]	TUNGGAL A T. The 40 biggest data breaches of all time (updated July 2026)[EB/OL]. https://www.upguard.com/blog/biggest-data-breaches, 2026.
[15]	ANUPRIYA. 17.5 million Instagram accounts exposed in major data leak[EB/OL]. https://cyberpress.org/instagram-data-leak/, 2026.
[16]	GRIGAS L. Do women and men have similar password habits?[EB/OL]. https://nordpass.com/blog/women-men-password-habits/, 2026.
[17]	NEWMAN M L, GROOM C J, HANDELMAN L D, et al. Gender differences in language use: An analysis of 14, 000 text samples[J]. Discourse Processes, 2008, 45(3): 211–236. doi: 10.1080/01638530802073712.
[18]	WANG Y C, BURKE M, and KRAUT R E. Gender, topic, and audience response: An analysis of user-generated content on Facebook[C]. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, Paris, France, 2013: 31–34. doi: 10.1145/2470654.2470659.
[19]	ANWAR M, HE Wu, ASH I, et al. Gender difference and employees' cybersecurity behaviors[J]. Computers in Human Behavior, 2017, 69: 437–443. doi: 10.1016/j.chb.2016.12.040.
[20]	WEI M, MINK J, EIGER Y, et al. SoK (or SoLK?): On the quantitative study of sociodemographic factors and computer security behaviors[C]. Proceedings of the 33rd USENIX Conference on Security Symposium, Philadelphia, USA, 2024: 392.
[21]	WEI M, EMAMI-NAEINI P, ROESNER F, et al. Skilled or Gullibleƒ gender stereotypes related to computer security and privacy[C]. 2023 IEEE Symposium on Security and Privacy, San Francisco, USA, 2023: 2050–2067. doi: 10.1109/SP46215.2023.10179469.
[22]	BRYANT K and CAMPBELL J. User behaviours associated with password security and management[J]. Australasian Journal of Information Systems, 2006, 14(1): 81–100. doi: 10.3127/ajis.v14i1.9.
[23]	BONNEAU J. The science of guessing: Analyzing an anonymized corpus of 70 million passwords[C]. 2012 IEEE Symposium on Security and Privacy, San Francisco, USA, 2012: 538–552. doi: 10.1109/SP.2012.49.
[24]	MAZUREK M L, KOMANDURI S, VIDAS T, et al. Measuring password guessability for an entire university[C]. Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, Berlin, Germany, 2013: 173–186. doi: 10.1145/2508859.2516726.
[25]	PETRIE H and MERDENYAN B. Cultural and gender differences in password behaviors: Evidence from China, Turkey and the UK[C]. Proceedings of the 9th Nordic Conference on Human-Computer Interaction, Gothenburg, Sweden, 2016: 9. doi: 10.1145/2971485.2971563.
[26]	WEIR M, AGGARWAL S, DE MEDEIROS B, et al. Password cracking using probabilistic context-free grammars[C]. 2009 30th IEEE Symposium on Security and Privacy, Oakland, USA, 2009: 391–405. doi: 10.1109/SP.2009.8.
[27]	WANG Ding, CHENG Haibo, WANG Ping, et al. Zipf’s law in passwords[J]. IEEE Transactions on Information Forensics and Security, 2017, 12(11): 2776–2791. doi: 10.1109/TIFS.2017.2721359.
[28]	WANG Ding, ZHANG Zijian, WANG Ping, et al. Targeted online password guessing: An underestimated threat[C]. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, 2016: 1242–1254. doi: 10.1145/2976749.2978339.
[29]	DAS A, BONNEAU J, CAESAR M, et al. The tangled web of password reuse[C]. 21st Annual Network and Distributed System Security Symposium, San Diego, USA, 2014: 1–15. doi: 10.14722/ndss.2014.23357.
[30]	PAL B, DANIEL T, CHATTERJEE R, et al. Beyond credential stuffing: Password similarity models using neural networks[C]. 2019 IEEE Symposium on Security and Privacy, San Francisco, USA, 2019: 417–434. doi: 10.1109/SP.2019.00056.
[31]	XIE Zhijie, SHI Fan, ZHANG Min, et al. GuessFuse: Hybrid password guessing with multi-view[J]. IEEE Transactions on Information Forensics and Security, 2024, 19: 4215–4230. doi: 10.1109/TIFS.2024.3376246.
[32]	WANG Ding, ZOU Yunkai, XIAO Yuan’an, et al. Pass2Edit: A multi-step generative model for guessing edited passwords[C]. Proceedings of the 32nd USENIX Conference on Security Symposium, Anaheim, USA, 2023: 56.
[33]	NISENOFF A, GOLLA M, WEI M, et al. A two-decade retrospective analysis of a university's vulnerability to attacks exploiting reused passwords[C]. Proceedings of the 32nd USENIX Conference on Security Symposium, Anaheim, USA, 2023: 287.
[34]	RAO A, JHA B, and KINI G. Effect of grammar on security of long passwords[C]. Proceedings of the Third ACM Conference on Data and Application Security and Privacy, San Antonio, USA, 2013: 317–324. doi: 10.1145/2435349.2435395.
[35]	WANG Ding, WANG Ping, HE Debiao, et al. Birthday, name and bifacial-security: Understanding passwords of Chinese web users[C]. Proceedings of the 28th USENIX Conference on Security Symposium, Santa Clara, USA, 2019: 1537–1554.
[36]	MOHAMMAD S M and TURNEY P D. Crowdsourcing a word-emotion association lexicon[J]. Computational Intelligence, 2013, 29(3): 436–465. doi: 10.1111/j.1467-8640.2012.00460.x.
[37]	FAST E, CHEN Binbin, and BERNSTEIN M S. Empath: Understanding topic signals in large-scale text[C]. Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems, San Jose, USA, 2016: 4647–4657. doi: 10.1145/2858036.2858535.
[38]	U. S. Social Security Administration. Baby names from Social Security card applications-national data[DB/OL]. https://catalog.data.gov/dataset/baby-names-from-social-security-card-applications-national-data, 2026.
[39]	XU Ming, YU Jitao, ZHANG Xinyi, et al. Improving real-world password guessing attacks via bi-directional transformers[C]. Proceedings of the 32nd USENIX Conference on Security Symposium, Anaheim, USA, 2023: 57.
[40]	LI Zhen and WANG Ding. Targeted password guessing using k-nearest neighbors[C]. 33rd Annual Network and Distributed System Security Symposium, San Diego, USA, 2026: 1–18. doi: 10.14722/ndss.2026.232077.
[41]	UR B, NOMA F, BEES J, et al. "I added '!' at the end to make it secure": Observing password creation in the lab[C]. Proceedings of the Eleventh USENIX Conference on Usable Privacy and Security, Ottawa, Canada, 2015: 123–140.
[42]	ZOU Yunkai, AN Maoxiang, and WANG Ding. Password guessing using large language models[C]. Proceedings of the 34th USENIX Conference on Security Symposium, Seattle, USA, 2025: 400.
[43]	MELICHER W, UR B, SEGRETI S M, et al. Fast, lean, and accurate: Modeling password guessability using neural networks[C]. Proceedings of the 25th USENIX Conference on Security Symposium, Austin, USA, 2016: 175–191.
[44]	MA J, YANG Weining, LUO Min, et al. A study of probabilistic password models[C]. Proceedings of the 2014 IEEE Symposium on Security and Privacy, Berkeley, USA, 2014: 689–704. doi: 10.1109/SP.2014.50.
[45]	咸鹤群, 张艺, 汪定, 等. CSNN: 基于汉语拼音与神经网络的口令集安全评估方法[J]. 电子与信息学报, 2020, 42(8): 1862–1871. doi: 10.11999/JEIT190856. XIAN Hequn, ZHANG Yi, WANG Ding, et al. CSNN: Password set security evaluation method based on Chinese syllables and neural network[J]. Journal of Electronics & Information Technology, 2020, 42(8): 1862–1871. doi: 10.11999/JEIT190856.
[46]	PASQUINI D, ATENIESE G, and TRONCOSO C. Universal neural-cracking-machines: Self-configurable password models from auxiliary data[C]. 2024 IEEE Symposium on Security and Privacy, San Francisco, USA, 2024: 1365–1384. doi: 10.1109/SP54263.2024.00032.
[47]	SU Xingyu, ZHU Xiaojie, LI Yang, et al. PagPassGPT: Pattern guided password guessing via generative pretrained transformer[C]. 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, Brisbane, Australia, 2024: 429–442. doi: 10.1109/DSN58291.2024.00049.
[48]	YANG Tao and WANG Ding. RankGuess: Password guessing using adversarial ranking[C]. 2025 IEEE Symposium on Security and Privacy, San Francisco, USA, 2025: 682–700. doi: 10.1109/SP61157.2025.00040.
[49]	ZOU Yunkai, WANG Ding, and DUAN Fei. Success rates doubled with only one character: Mask password guessing[C]. 33rd Annual Network and Distributed System Security Symposium, San Diego, USA, 2026: 1–18. doi: 10.14722/ndss.2026.241059.
[50]	ORENBACH Y and WOOL A. Watch and crack: Password inference from smart-glasses video[EB/OL]. https://arxiv.org/abs/2609.06539, 2026. doi: 10.48550/arXiv.2609.06539.
[51]	DUAN Mingjian, XU Ming, ZHANG Shenghao, et al. MoPE: A mixture of password experts for improving password guessing[C]. 2026 IEEE Symposium on Security and Privacy, San Francisco, USA, 2026: 3017–3036. doi: 10.1109/SP63933.2026.00191.
[52]	WANG Chenyang, SHI Fan, ZHANG Min, et al. CoT-DPG: A co-training based dynamic password guessing method[C]. 33rd Annual Network and Distributed System Security Symposium, San Diego, USA, 2026: 1–16. doi: 10.14722/ndss.2026.230755.
[53]	邹云开, 汪定. 口令猜测研究进展[J]. 密码学报, 2024, 11(1): 67–100. doi: 10.13868/j.cnki.jcr.000670. ZOU Yunkai and WANG Ding. Advances on password guessing attack[J]. Journal of Cryptologic Research, 2024, 11(1): 67–100. doi: 10.13868/j.cnki.jcr.000670.
[54]	CORRIAS W, DE GASPARI F, HITAJ D, et al. MAYA: Addressing inconsistencies in generative password guessing through a unified benchmark[C]. 2026 IEEE Symposium on Security and Privacy, San Francisco, USA, 2026: 2957–2976. doi: 10.1109/SP63933.2026.00081.
[55]	DELL’AMICO M and FILIPPONE M. Monte Carlo strength evaluation: Fast and reliable password checking[C]. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, USA, 2015: 158–169. doi: 10.1145/2810103.2813631.
[56]	JUOZAPAVIČIUS A, BRILINGAITĖ A, BUKAUSKAS L, et al. Age and gender impact on password hygiene[J]. Applied Sciences, 2022, 12(2): 894. doi: 10.3390/app12020894.