MDIGuess: Improving Targeted Password Guessing by Combining Multi-Dimensional Heterogeneous Information

Passwords have been widely used for authentication, yet they face significant security risks due to the progress of modern targeted guessing attack methods. Understanding the risks of targeted password guessing is crucial for improving the security of many critical network systems. While current approaches can effectively utilize specific leaked data, they typically treat these sources in isolation. Failing to account for the combined effects of heterogeneous user-specific information and population-level password priors can lead to an underestimation of password vulnerability, highlighting the need for a more comprehensive targeted guessing framework. To this end, we propose MDIGuess, an autoregressive neural framework for targeted password guessing with explicit multi-dimensional information utilization. MDIGuess organizes exploitable information into three dimensions: historical passwords, personally identifiable information (PII), and general leaked-password data. Historical passwords capture reuse and modification behaviors, PII provides user-specific lexical cues, and general leaked passwords provide population-level priors through popular-list integration and autoregressive pre-training. Extensive experiments on eight attack scenarios built from nine large-scale password datasets show that MDIGuess achieves an average cracking success rate of 35.14% within 1,000 guesses, improving by 43.64% on average over four state-of-the-art targeted guessing baselines. Furthermore, analyses on representative scenarios show that targeted popular-list integration and autoregressive pre-training can further improve guessing performance, with additional Top-1,000 gains of 0.87%–1.39%. A PII-rich scenario also confirms that non-email attributes such as username, name, and birthday can provide useful personalized signals. Finally, we develop MDI-PSM, an attack-aware password strength meter that better reflects targeted guessing risks by incorporating multi-dimensional targeted-risk signals. These results provide a more realistic basis for evaluating password vulnerability under targeted guessing attacks.