This will not be a full answer, since a full answer is not possible: A credential can be anything that you may want to make into a credential. But assuming that the credentials are sensible we can argue about two things:
The first paper you mention simply makes a scheme in which an unauthorized access provokes an alarm (wrong codeword in the paper) which disables the key. In implementation terms this isn't much different from: "after three unsuccessful logins the password is blocked".
The novelty of the paper is only that they make a full keyscheme (with formal analysis of the scheme).
The second paper talks about something completely different. It is just an enumeration of how systems that publish user data to the web (e.g. github or bitbucket, but it could well be facebook) try to find that inside the published data there are strings that look like credentials to somewhere else. This is pretty similar to what scumblr can be configured to do. Their list of techniques includes rather simple points:
- keyword search (e.g.
BEGIN RSA PRIVATE KEY)
- pattern match (e.g. search for base64 encoded strings)
- heuristics (pattern match but using context)
- source search (pattern match but using guesses based on the type of source code it is searching)
These things work, I remember receiving an email from BitBucket when once upon a time I submitted my AWS API key to a repository. But as for their implementation as a specific tool I believe they're just scripts that are invoked as git hooks. Look at this image in the paper:
The "key detection module" is called between a user commit and the actual commit to the public repository.
Github and BitBucket certainly has a database of patterns that are likely to be credentials. And also they certainly have a couple of heuristic algorithms. Points 1 (keyword search) and 2 (pattern match) are trivial to implement with grep, points 3 (heuristics) and 4 (source search) require a good deal of pre-existing data which only places like Github and BitBucket would have.
Finally note that even the paper argues that the heuristics and source search produce both false negatives and false positives. Therefore there is no magical solution here.
Had I needed something to check for users on my website publishing their credentials to somewhere by accident I'd try to use points 1 (keyword match) and 2 (pattern matching) and then simply build a heuristic algorithm that does not depend on so much on pre-existing data. On way would be to try Kolmogorov complexity (see this old question about string complexity from more info).
The assumption is that complex credentials will have a lot of entropy by byte since they should be difficult to brute-force. This is a bad assumption in some cases: for example base64 encoded strings have little complexity compared to their length. We will need to catch base64 strings in the pattern match phase (phase 2).
Here is a trivial (it uses zlib to approximate Kolmogorov complexity, which isn't particularly close) heuristic algorithm using the assumption above:
from io import BytesIO
strings = [ b'password password password password'
, b'correct horse batter staple'
for s in strings:
fp = BytesIO()
zf = zipfile.ZipFile(fp, 'w', zipfile.ZIP_DEFLATED)
print('%50s' % s, float(len(fp.getvalue())) / float(len(s)) )
And its output:
b'password password password password' 3.257142857142857
b'correct horse batter staple' 4.777777777777778
As expected it works well to separate simple strings from strings that are sets of more-or-less random bytes. Yet, it works badly on base64 strings and even on some passphrases.