Teburin Abubuwan Ciki
- 1. Gabatarwa
- 2. Hanyoyin Bincike
- 3. Sakamako
- 4. Muhimman Bayanai
- 5. Cikakkun Bayanai na Fasaha & Dabaru
- 6. Sakamakon Gwaji & Hotuna
- 7. Misalin Tsarin Bincike
- 8. Aikace-aikace na Gaba & Hasashe
- 9. Bincike na Asali
- 10. Manazarta
1. Gabatarwa
Kalmomin sirri sun kasance hanyar tantancewa mafi rinjaye ga ayyukan kan layi duk da sanannun lahani na tsaro. Masu amfani galibi suna fafitikar ƙirƙirar kalmomin sirri masu ƙarfi, na musamman saboda iyakokin fahimta da yawan asusun da ke ƙaruwa. Ana ba da shawarar manajan kalmar sirri akai-akai a matsayin mafita, suna yin alkawarin adanawa, cikawa ta atomatik, da samar da kalmomin sirri masu ƙarfi. Duk da haka, ayyukan da suka gabata ba su yi nazarin tasirinsu na ainihi akan ƙarfin kalmar sirri da sake amfani da su ba. Wannan takarda ta gabatar da babban bincike na farko don cike wannan gibi, ta yin amfani da haɗin binciken kan layi da sa ido a wurin ta hanyar plugin na burauza.
2. Hanyoyin Bincike
2.1 Tsarin Bincike
Mun gudanar da binciken kan layi tare da mahalarta 476 don fahimtar dabarun ƙirƙira da sarrafa kalmar sirri. Binciken ya haɗa da tambayoyi game da amfani da manajan kalmar sirri, halayen samar da kalmar sirri, da ƙarfin kalmar sirri da aka ruwaito da kai.
2.2 Sa Ido a Wurin ta Hanyar Plugin na Burauza
Daga cikin masu amsa binciken, mahalarta 170 sun shigar da plugin na burauza wanda ke sa ido kan shigar da kalmar sirri a lokaci-lokaci. Plugin ɗin ya rubuta kalmar sirri da kanta (an ɓoye ta don sirri), hanyar shigarwa (mutum ya buga vs. cikawa ta atomatik ta manajan), da yankin gidan yanar gizon. Wannan ya ba mu damar tattara bayanai na haƙiƙa game da ƙarfin kalmar sirri da sake amfani ba tare da dogaro da rahotannin kai ba.
2.3 Tattaro Mahalarta
An tattaro mahalarta ta hanyar tallace-tallace na kan layi da jerin gidajen wasiƙa na jami'a. Samfurin ƙarshe na mahalarta sa ido 170 ya bambanta a shekaru, jinsi, da asalin fasaha, kodayake ya ɗan karkata zuwa ga matasa, masu amfani da fasaha.
3. Sakamako
3.1 Nazarin Ƙarfin Kalmar Sirri
Mun auna ƙarfin kalmar sirri ta amfani da entropy na Shannon da ɗakin karatu na zxcvbn. Kalmomin sirri da aka shigar ta hanyar manajan kalmar sirri suna da entropy mafi girma (matsakaici $H \approx 52.3$ bits) idan aka kwatanta da kalmomin sirri da mutum ya buga (matsakaici $H \approx 28.7$ bits). Duk da haka, wannan fa'ida ta dogara ne akan manajan ya haɗa da mai samar da kalmar sirri; manajan da aka yi amfani da su kawai azaman ajiya sun nuna kalmomin sirri marasa ƙarfi.
3.2 Hanyoyin Sake Amfani da Kalmar Sirri
An auna sake amfani da kalmar sirri ta hanyar ƙidaya adadin gidajen yanar gizo daban-daban inda hash ɗin kalmar sirri ɗaya ya bayyana. Masu amfani da manajan kalmar sirri tare da masu samarwa sun sake amfani da kalmomin sirri a matsakaicin shafuka 1.2, yayin da masu amfani da ba manajan ba su sake amfani da shafuka 4.7. Manajan ba tare da masu samarwa ba sun nuna sake amfani da matsakaici (shafuka 2.8), yana nuna cewa ajiya kawai baya magance matsalar sake amfani gaba ɗaya.
3.3 Tasirin Masu Samar da Kalmar Sirri
Kasancewar mai samar da kalmar sirri da aka gina a ciki shine muhimmin abu. Manajan da ke samar da kalmomin sirri ta atomatik sun samar da kalmomin sirri masu ƙarfi da na musamman. Sabanin haka, manajan da aka yi amfani da su kawai azaman rumbun kalmar sirri (misali, adana kalmomin sirri da mai amfani ya ƙirƙira) sun nuna haɓaka kaɗan kawai idan aka kwatanta da babu manajan kwata-kwata.
4. Muhimman Bayanai
- Manajan kalmar sirri suna inganta ƙarfi da keɓantacce, amma kawai idan an haɗa su da mai samar da kalmar sirri.
- Manajan da aka yi amfani da su azaman ajiya zalla na iya ƙara tsananta matsalar ta hanyar ƙarfafa masu amfani su adana kalmomin sirri marasa ƙarfi, waɗanda aka sake amfani da su.
- Dabarun mai amfani yana da mahimmanci: ajiya mai wucewa vs. samarwa mai aiki yana haifar da sakamakon tsaro daban-daban.
- Sa ido a wurin yana ba da bayanai mafi aminci fiye da binciken da aka ruwaito da kai.
5. Cikakkun Bayanai na Fasaha & Dabaru
An ƙididdige ƙarfin kalmar sirri ta amfani da entropy na Shannon:
$H = -\sum_{i=1}^{n} p(x_i) \log_2 p(x_i)$
inda $p(x_i)$ shine yuwuwar harafin $x_i$ a cikin kalmar sirri. Don ƙididdige ƙididdiga na aiki, mun yi amfani da ɗakin karatu na zxcvbn, wanda ke ƙididdige entropy bisa ga daidaita tsari (misali, kalmomin ƙamus, jerin maɓallan rubutu).
An auna sake amfani da shi azaman matsakaicin adadin yankuna daban-daban a kowane hash ɗin kalmar sirri na musamman:
$R = \frac{\text{total passwords}}{\text{unique hashes}}$
6. Sakamakon Gwaji & Hotuna
Hoto 1: Entropy na Kalmar Sirri ta Hanyar Shigarwa
Ginshiƙi mai kwatanta matsakaicin entropy don mutum ya buga (28.7 bits), manajan ya adana (34.1 bits), da manajan ya samar (52.3 bits) kalmomin sirri. Sandunan kuskure suna nuna tazarar amincewa 95%.
Hoto 2: Sake Amfani da Kalmar Sirri ta Nau'in Manajan
Ginshiƙi na layi yana nuna matsakaicin adadin shafuka kowace kalmar sirri don babu manajan (4.7), manajan ba tare da mai samarwa ba (2.8), da manajan tare da mai samarwa (1.2). Yanayin ƙasa yana tabbatar da fa'idar masu samarwa.
Tebur 1: Ƙididdigar Taƙaice
| Rukuni | Matsakaicin Entropy (bits) | Matsakaicin Sake Amfani (shafuka) |
|---|---|---|
| Babu Manajan | 28.7 | 4.7 |
| Manajan (babu mai samarwa) | 34.1 | 2.8 |
| Manajan (tare da mai samarwa) | 52.3 | 1.2 |
7. Misalin Tsarin Bincike
Nazarin Shari'a: Kimanta Tasirin Manajan Kalmar Sirri
Yi la'akari da mai amfani wanda ya ɗauki manajan kalmar sirri. Tsarin bincike ya ƙunshi matakai uku:
- Asalin kafin ɗauka: Auna entropy na kalmar sirri na yanzu da ƙimar sake amfani ta hanyar plugin na burauza na makonni 2.
- Shiga tsakani: Gabatar da manajan kalmar sirri kuma umurci mai amfani da ya yi amfani da mai samar da kalmar sirri don duk sabbin asusun.
- Auna bayan ɗauka: Sa ido na wasu makonni 2, kwatanta entropy da sake amfani.
Sakamakon da ake tsammani: Entropy yana ƙaruwa daga ~28 bits zuwa ~50 bits; sake amfani ya ragu daga ~4.5 shafuka zuwa ~1.2 shafuka.
8. Aikace-aikace na Gaba & Hasashe
Wannan binciken yana da tasiri kai tsaye ga ƙirar manajan kalmar sirri da ilimin mai amfani. Aikin gaba ya kamata ya bincika:
- Nazarin dogon lokaci don ganin ko fa'idodin sun ci gaba na tsawon shekaru.
- Haɗin kai tare da bayanan halitta don rage dogaro da kalmomin sirri na shugaba.
- Masu samarwa masu sanin yanayi waɗanda ke daidaita rikitarwar kalmar sirri zuwa buƙatun tsaro na gidan yanar gizo.
- Wasanni don ƙarfafa masu amfani su ɗauki masu samarwa.
- Tura kamfani don aiwatar da manufofin kalmar sirri a cikin ƙungiyoyi.
9. Bincike na Asali
Mahimman Bayani: Manajan kalmar sirri ba su ne maganin azurfa ba—fa'idar tsaron su gaba ɗaya ta dogara ne akan haɗa mai samar da kalmar sirri mai aiki. Idan ba tare da shi ba, suna kawai sarrafa munanan halaye iri ɗaya da masu amfani ke da su.
Tsarin Ma'ana: Binciken yana ci gaba da ma'ana daga bincike zuwa sa ido a wurin, yana ware tasirin manajan kalmar sirri ta hanyar shigarwa. Bayanan sun nuna a sarari rarrabuwa: manajan tare da masu samarwa suna samar da kalmomin sirri masu ƙarfi, na musamman; manajan ba tare da masu samarwa ba suna samar da haɓaka kaɗan kawai. Wannan ya karyata zato mara tushe cewa kowane manajan kalmar sirri ya fi babu.
Ƙarfi & Lahani: Babban ƙarfin shine tattara bayanai a wurin, wanda ke guje wa son zuciya na rahoton kai. Duk da haka, samfurin yana karkata zuwa ga matasa da masu fasaha, yana iyakance gama gari. Bugu da ƙari, binciken bai yi la'akari da ƙarfin kalmar sirri na shugaba ba, wanda shine babban lahani a kowane tsarin manajan kalmar sirri. Kamar yadda binciken USENIX Security 2021 kan lahani na manajan kalmar sirri ya lura, raunin kalmar sirri na shugaba na iya lalata duk kalmomin sirri da aka adana.
Bayanan da Za a Iya Aiki: Ga masu aiki, saƙon a bayyane yake: tura manajan kalmar sirri waɗanda ke tilasta amfani da mai samar da kalmar sirri. Ga masu bincike, binciken yana buɗe kofa don bincika dalilin da yasa masu amfani ke tsayayya da masu samarwa da yadda za a tsara shiga tsakani da ke tura su zuwa ga kyakkyawan hali. Taron bitar IEEE S&P 2020 kan tsaro mai amfani ya yi kira don ƙarin irin waɗannan nazarce-nazarcen da suka dace da muhalli.
10. Manazarta
- Ghorbani Lyastani, S., Schilling, M., Fahl, S., Bugiel, S., & Backes, M. (2020). Studying the Impact of Managers on Password Strength and Reuse. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security.
- Pearce, P., et al. (2021). An Empirical Study of Password Manager Vulnerabilities. USENIX Security Symposium.
- Shannon, C. E. (1948). A Mathematical Theory of Communication. Bell System Technical Journal, 27(3), 379–423.
- Wheeler, D. L. (2016). zxcvbn: Low-Budget Password Strength Estimation. USENIX Security Symposium.
- Stobert, E., & Biddle, R. (2014). The Password Life Cycle: User Behaviour in Managing Passwords. SOUPS.