{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T04:15:44Z","timestamp":1787890544786,"version":"build-2784847793"},"reference-count":47,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2020,12,31]],"date-time":"2020-12-31T00:00:00Z","timestamp":1609372800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"<jats:p>Passwords should be easy to remember, yet expiration policies mandate their frequent change. Caught in the crossfire between these conflicting requirements, users often adopt creative methods to perform slight variations over time. While easily fooling the most basic checks for similarity, these schemes lead to a substantial decrease in actual security, because leaked passwords, albeit expired, can be effectively exploited as seeds for crackers. This work describes an approach based on Bloom Filters to detect password similarity, which can be used to discourage password reuse habits. The proposed scheme intrinsically obfuscates the stored passwords to protect them in case of database leaks, and can be tuned to be resistant to common cryptanalytic techniques, making it suitable for usage on exposed systems.<\/jats:p>","DOI":"10.3390\/jcp1010005","type":"journal-article","created":{"date-parts":[[2020,12,31]],"date-time":"2020-12-31T10:10:37Z","timestamp":1609409437000},"page":"78-92","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Password Similarity Using Probabilistic Data Structures"],"prefix":"10.3390","volume":"1","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2473-2439","authenticated-orcid":false,"given":"Davide","family":"Berardi","sequence":"first","affiliation":[{"name":"Dipartimento di Informatica Scienza e Ingegneria (DISI), Universit\u00e0 di Bologna, 40126 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6669-8072","authenticated-orcid":false,"given":"Franco","family":"Callegati","sequence":"additional","affiliation":[{"name":"Dipartimento di Informatica Scienza e Ingegneria (DISI), Universit\u00e0 di Bologna, 40126 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0101-2551","authenticated-orcid":false,"given":"Andrea","family":"Melis","sequence":"additional","affiliation":[{"name":"Dipartimento di Informatica Scienza e Ingegneria (DISI), Universit\u00e0 di Bologna, 40126 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3962-5513","authenticated-orcid":false,"given":"Marco","family":"Prandini","sequence":"additional","affiliation":[{"name":"Dipartimento di Informatica Scienza e Ingegneria (DISI), Universit\u00e0 di Bologna, 40126 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2020,12,31]]},"reference":[{"key":"ref_1","first-page":"136","article-title":"Two-factor authentication: Too little, too late","volume":"48","author":"Schneier","year":"2005","journal-title":"Commun. ACM"},{"key":"ref_2","unstructured":"Scheidt, E.M., Domanque, E., Butler, R., and Tsang, W. (2007). Access System Utilizing Multiple Factor Identification and Authentication. (7,178,025), U.S. Patent."},{"key":"ref_3","unstructured":"Stobert, E., and Biddle, R. (2014, January 9\u201311). The password life cycle: User behaviour in managing passwords. Proceedings of the 10th Symposium on Usable Privacy and Security, Menlo Park, CA, USA."},{"key":"ref_4","first-page":"707","article-title":"Binary codes capable of correcting deletions, insertions, and reversals","volume":"10","author":"Levenshtein","year":"1966","journal-title":"Sov. Phys. Dokl."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Schnell, R., Bachteler, T., and Reiher, J. (2009). Privacy-preserving record linkage using Bloom filters. BMC Med. Inform. Decis. Mak., 9.","DOI":"10.1186\/1472-6947-9-41"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Alaggan, M., Gambs, S., and Kermarrec, A.M. (2012). BLIP: Non-interactive differentially-private similarity computation on bloom filters. Stabilization, Safety, and Security of Distributed Systems, Springer.","DOI":"10.1007\/978-3-642-33536-5_20"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Erlingsson, \u00da., Pihur, V., and Korolova, A. (2014, January 3\u20137). Rappor: Randomized aggregatable privacy-preserving ordinal response. Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA.","DOI":"10.1145\/2660267.2660348"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Forman, S., and Samanthula, B.K. (2018, January 3\u20135). Secure Similar Document Detection: Optimized Computation Using the Jaccard Coefficient. Proceedings of the 2018 IEEE 4th International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing, (HPSC) and IEEE International Conference on Intelligent Data and Security (IDS), Omaha, NE, USA.","DOI":"10.1109\/BDS\/HPSC\/IDS18.2018.00015"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"91","DOI":"10.1016\/j.diin.2006.06.015","article-title":"Identifying almost identical files using context triggered piecewise hashing","volume":"3","author":"Kornblum","year":"2006","journal-title":"Digit. Investig."},{"key":"ref_10","unstructured":"Li, Y., Sundaramurthy, S.C., Bardas, A.G., Ou, X., Caragea, D., Hu, X., and Jang, J. (2015, January 10). Experimental study of fuzzy hashing in malware clustering analysis. Proceedings of the 8th Workshop on Cyber Security Experimentation and Test (CSET\u201915), Washington, DC, USA."},{"key":"ref_11","unstructured":"Grassi, P.A., Garcia, M.E., and Fenton, J.L. (2017). DRAFT NIST Special Publication 800-63-3 Digital Identity Guidelines."},{"key":"ref_12","unstructured":"(2020, December 15). Facebook Buys Black Market Passwords to Keep Your Account Safe. Available online: https:\/\/www.cnet.com\/news\/facebook-chief-security-officer-alex-stamos-web-summit-lisbon-hackers\/."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"75","DOI":"10.1145\/975817.975820","article-title":"The domino effect of password reuse","volume":"47","author":"Ives","year":"2004","journal-title":"Commun. ACM"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Liu, Y., Xia, Z., Yi, P., Yao, Y., Xie, T., Wang, W., and Zhu, T. (2018, January 20\u201324). GENPass: A general deep learning model for password guessing with PCFG rules and adversarial generation. Proceedings of the 2018 IEEE International Conference on Communications (ICC), Kansas City, MO, USA.","DOI":"10.1109\/ICC.2018.8422243"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"43","DOI":"10.1108\/09685229610114204","article-title":"Constructing difficult-to-guess passwords","volume":"4","author":"Wood","year":"1996","journal-title":"Inf. Manag. Comput. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"422","DOI":"10.1145\/362686.362692","article-title":"Space\/time trade-offs in hash coding with allowable errors","volume":"13","author":"Bloom","year":"1970","journal-title":"Commun. ACM"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"604","DOI":"10.1109\/TNET.2002.803864","article-title":"Compressed Bloom filters","volume":"10","author":"Mitzenmacher","year":"2002","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"600","DOI":"10.1145\/358628.358632","article-title":"Designing a Bloom filter for differential file access","volume":"25","author":"Gremillion","year":"1982","journal-title":"Commun. ACM"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Aum\u00fcller, M., Christiani, T., Pagh, R., and Silvestri, F. (2018, January 10\u201315). Distance-sensitive hashing. Proceedings of the 37th ACM SIGMOD-SIGACT-SIGAI Symposium on Principles of Database Systems, Houston, TX, USA.","DOI":"10.1145\/3196959.3196976"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Kirsch, A., and Mitzenmacher, M. (2006, January 21). Distance-sensitive bloom filters. Proceedings of the 2006 Eighth Workshop on Algorithm Engineering and Experiments (ALENEX), Miami, FL, USA.","DOI":"10.1137\/1.9781611972863.4"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Indyk, P., and Motwani, R. (1998, January 23\u201326). Approximate nearest neighbors: Towards removing the curse of dimensionality. Proceedings of the Thirtieth Annual ACM Symposium on Theory of Computing, Dallas, TX, USA.","DOI":"10.1145\/276698.276876"},{"key":"ref_22","first-page":"518","article-title":"Similarity search in high dimensions via hashing","volume":"99","author":"Gionis","year":"1999","journal-title":"Vldb"},{"key":"ref_23","first-page":"1","article-title":"Evaluation of approximate comparison methods on Bloom filters for probabilistic linkage","volume":"4","author":"Brown","year":"2019","journal-title":"Int. J. Popul. Data Sci."},{"key":"ref_24","first-page":"385","article-title":"Le Coefficient Generique et le Coefficient de Communaute Dans la Flore Marocaine","volume":"14","author":"Jaccard","year":"1926","journal-title":"M\u00e9moires de la Soci\u00e9t\u00e9 Vaudoise des Sciences Naturelles"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"297","DOI":"10.2307\/1932409","article-title":"Measures of the amount of ecologic association between species","volume":"26","author":"Dice","year":"1945","journal-title":"Ecology"},{"key":"ref_26","unstructured":"Barkman, J.J. (1958). Phytosociology and Ecology of Cryptogamic Epiphytes (Including a Taxonomic Survey and Description of Their Vegetation Units in Europe), Barkman Van Gorcum & Company. N. V."},{"key":"ref_27","unstructured":"Niwattanakul, S., Singthongchai, J., Naenudorn, E., and Wanapu, S. (2013, January 13\u201315). Using of Jaccard coefficient for keywords similarity. Proceedings of the International Multiconference of Engineers and Computer Scientists, Hong Kong, China."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Vatsalan, D., Sehili, Z., Christen, P., and Rahm, E. (2017). Privacy-preserving record linkage for big data: Current approaches and research challenges. Handbook of Big Data Technologies, Springer.","DOI":"10.1007\/978-3-319-49340-4_25"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Niedermeyer, F., Steinmetzer, S., Kroll, M., and Schnell, R. (2014). Cryptanalysis of Basic Bloom Filters Used for Privacy Preserving Record Linkage, German Record Linkage Center.","DOI":"10.2139\/ssrn.3530867"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Manalu, D.R., Rajagukguk, E., Siringoringo, R., Siahaan, D.K., and Sihombing, P. (2019, January 16\u201317). The Development of Document Similarity Detector by Jaccard Formulation. Proceedings of the 2019 International Conference of Computer Science and Information Technology (ICoSNIKOM), Jember, Indonesia.","DOI":"10.1109\/ICoSNIKOM48755.2019.9111494"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Ji, S., Yang, S., Das, A., Hu, X., and Beyah, R. (2017, January 1\u20134). Password correlation: Quantification, evaluation and application. Proceedings of the IEEE INFOCOM 2017-IEEE Conference on Computer Communications, Atlanta, GA, USA.","DOI":"10.1109\/INFOCOM.2017.8057067"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1080\/15427951.2004.10129096","article-title":"Network applications of bloom filters: A survey","volume":"1","author":"Broder","year":"2004","journal-title":"Internet Math."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Nergiz, M.E., Atzori, M., and Clifton, C. (2007, January 12\u201314). Hiding the presence of individuals from shared databases. Proceedings of the 2007 ACM SIGMOD International Conference on Management of Data, Beijing, China.","DOI":"10.1145\/1247480.1247554"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Dwork, C. (2008). Differential privacy: A survey of results. International Conference on Theory and Applications of Models of Computation, Springer.","DOI":"10.1007\/978-3-540-79228-4_1"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Bianchi, G., Bracciale, L., and Loreti, P. (2012). \u201cBetter Than Nothing\u201d Privacy with Bloom Filters: To What Extent? International Conference on Privacy in Statistical Databases, Springer.","DOI":"10.1007\/978-3-642-33627-0_27"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"2973","DOI":"10.1109\/TIFS.2020.2980835","article-title":"Sequence Data Matching and Beyond: New Privacy-Preserving Primitives Based on Bloom Filters","volume":"15","author":"Xue","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_37","unstructured":"Appleby, A. (2020, December 30). Murmurhash 2.0, Available online: https:\/\/sites.google.com\/site\/murmurhash\/."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Gueron, S., Johnson, S., and Walker, J. (2011, January 11\u201313). SHA-512\/256. Proceedings of the 2011 Eighth International Conference on Information Technology: New Generations, Las Vegas, Nevada, USA.","DOI":"10.1109\/ITNG.2011.69"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Gilbert, H., and Handschuh, H. (2003). Security analysis of SHA-256 and sisters. International Workshop on Selected Areas in Cryptography, Springer.","DOI":"10.1007\/978-3-540-24654-1_13"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Kim, J., Biryukov, A., Preneel, B., and Hong, S. (2006). On the security of HMAC and NMAC based on HAVAL, MD4, MD5, SHA-0 and SHA-1. International Conference on Security and Cryptography for Networks, Springer.","DOI":"10.1007\/11832072_17"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"\u00c1lvarez-S\u00e1nchez, R., Andrade-Bazurto, A., Santos-Gonz\u00e1lez, I., and Zamora-G\u00f3mez, A. (2017, January 6\u20138). AES-CTR as a password-hashing function. Proceedings of the International Joint Conference SOCO\u201917-CISIS\u201917- ICEUTE\u201917, Le\u00f3n, Spain.","DOI":"10.1007\/978-3-319-67180-2_59"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Gutterman, Z., Pinkas, B., and Reinman, T. (2006, January 21\u201324). Analysis of the linux random number generator. Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P\u201906), Oakland, CA, USA.","DOI":"10.1109\/SP.2006.5"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Gasser, M. (1975). A Random Word Generator for Pronounceable Passwords, Mitre Corp.. Technical Report.","DOI":"10.21236\/ADA017676"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Florencio, D., and Herley, C. (2007, January 8\u201312). A large-scale study of web password habits. Proceedings of the 16th International Conference on World Wide Web, Banff, AB, Canada.","DOI":"10.1145\/1242572.1242661"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"51071","DOI":"10.1109\/ACCESS.2020.2980235","article-title":"A Survey on Privacy Properties for Data Publishing of Relational Data","volume":"8","author":"Zigomitros","year":"2020","journal-title":"IEEE Access"},{"key":"ref_46","first-page":"16","article-title":"Comparison of various Anonymization Technique","volume":"5","author":"Pannu","year":"2017","journal-title":"Int. J. Sci. Res. Netw. Secur. Commun."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Cheon, J.H., Kim, M., and Lauter, K. (2015). Homomorphic computation of edit distance. International Conference on Financial Cryptography and Data Security, Springer.","DOI":"10.1007\/978-3-662-48051-9_15"}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/1\/1\/5\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T10:48:19Z","timestamp":1760179699000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/1\/1\/5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,12,31]]},"references-count":47,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2021,3]]}},"alternative-id":["jcp1010005"],"URL":"https:\/\/doi.org\/10.3390\/jcp1010005","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,12,31]]}}}