Continuously preventing weak password attacks is one of the most important initiatives to secure IoT systems. Password strength meters can guide users to create secure passwords, but in our investigation, we found that current password strength meters in mainstream IoT systems overestimate the strength of passwords with digit segments, leading users to choose passwords they thought were secure but are actually not. Therefore, we conduct a more in-depth and comprehensive study on the semantic characteristics of digit segments in passwords than ever before. We obtained unpublished high-frequency digit semantic patterns through semantic extraction methods and improved the PCFG attack by utilizing these newly discovered semantic pattern characteristics. The experimental results show that the semantic characteristics of digit segments have an important impact on the strength of user passwords. Finally, we propose a feasible scheme to improve the password strength meter for IoT systems based on the high-frequency semantic characteristics of digit segments.

Continuously preventing weak password attacks is one of the most important initiatives to secure IoT and smart contract platforms. Despite their significance as crucial components of passwords, special character segments have been overlooked. This study systematically studies the basic characteristics and semantic patterns of special character segments. We assess the efficacy of special character segment characteristics in cracking trials through assimilation into the latest Probabilistic Context-Free Grammar (PCFGv4) method for password cracking by updating the pre-terminal structure or performing special character segment transformation. Experimental findings demonstrate that a mere 6% transformation rate improves the cracking rate by 3.72% under the optimal assimilation combination. Our investigation reveals that the current password creation policies of mainstream IoT platforms and smart contract wallets overestimate the strength of passwords with special characters. To enhance their passwords, users can employ low-frequency special character semantic strings. For IoT platforms or smart contract wallets, the use of blacklist constructed from special character segment characteristics can effectively mitigate the risk of overestimating the strength of passwords with special characters.