User Study, Analysis, and Usable Security of Passwords Based on Digital Objects

Despite all efforts, password schemes intended to deploy or encourage the use of strong passwords have largely failed. As an alternative to enable users to create, maintain, and use high-quality passwords willingly, we propose Object-based Password (ObPwd), leveraging the universe of personal or personally meaningful digital content that many users now own or have access to. ObPwd converts user-selected digital objects to high-entropy text passwords. Memorization of exact passwords is replaced by remembering password objects. We present the design details, variants, and usability and security analysis of ObPwd, and report on the results of a hybrid in-lab/at-home user study on 32 participants. The results suggest the scheme has good usability, with excellent memorability, acceptable login times, and very positive user perception, achieved while providing strong security for the threat context explored. We believe this work lays the foundation for a promising password selection paradigm.

[1]  Eugene H. Spafford,et al.  The internet worm: crisis and aftermath , 1989 .

[2]  Sudhir Aggarwal,et al.  Testing metrics for password creation policies by attacking large sets of revealed passwords , 2010, CCS '10.

[3]  Ka-Ping Yee,et al.  Passpet: convenient password management and phishing protection , 2006, SOUPS '06.

[4]  Dan Boneh,et al.  Stronger Password Authentication Using Browser Extensions , 2005, USENIX Security Symposium.

[5]  Cormac Herley,et al.  Do Strong Web Passwords Accomplish Anything? , 2007, HotSec.

[6]  Neil Haller,et al.  The S/KEY One-Time Password System , 1995, RFC.

[7]  Michael K. Reiter,et al.  On User Choice in Graphical Password Schemes , 2004, USENIX Security Symposium.

[8]  Robert Biddle,et al.  Graphical passwords: Learning from the first twelve years , 2012, CSUR.

[9]  Robert Biddle,et al.  The Usable Security of Passwords based on Digital Objects : From Design and Analysis to User Study ∗ , 2010 .

[10]  Robin Berthier,et al.  Profiling Attacker Behavior Following SSH Compromises , 2007, 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN'07).

[11]  J. Massey.  Guessing and entropy , 1994, Proceedings of 1994 IEEE International Symposium on Information Theory.

[12]  Alain Forget,et al.  Multiple password interference in text passwords and click-based graphical passwords , 2009, CCS.

[13]  P. V. Oorschot,et al.  Multiple Password Interference in Text and Click-Based Graphical Passwords , 2008 .

[14]  Paul C. van Oorschot,et al.  Digital Objects as Passwords , 2008, HotSec.

[15]  Cormac Herley,et al.  A large-scale study of web password habits , 2007, WWW '07.

[16]  Tadayoshi Kohno,et al.  A comprehensive study of frequency, interference, and training of multiple graphical passwords , 2009, CHI.

[17]  John O. Pliam.  On the Incomparability of Entropy and Marginal Guesswork in Brute-Force Attacks , 2000, INDOCRYPT.

[18]  Rosalind W. Picard.  Affective Computing , 1997 .

[19]  Julie Thorpe,et al.  On predictive models and user-drawn graphical passwords , 2008, TSEC.

[20]  L. R. Peterson,et al.  Short-term retention of individual verbal items. , 1959, Journal of experimental psychology.

[21]  Ying Zhu,et al.  Graphical passwords: a survey , 2005, 21st Annual Computer Security Applications Conference (ACSAC'05).

[22]  Cormac Herley,et al.  So long, and no thanks for the externalities: the rational rejection of security advice by users , 2009, NSPW '09.

[23]  Carsten Maple,et al.  Musipass: authenticating me softly with "my" song , 2009, NSPW '09.

[24]  Alain Forget,et al.  Improving text passwords through persuasion , 2008, SOUPS '08.

[25]  Eric R. Verheul,et al.  Selecting Secure Passwords , 2007, CT-RSA.

[26]  Eugene H. Spafford,et al.  Crisis and aftermath , 1989, Commun. ACM.

[27]  Robert Biddle,et al.  A Usability Study and Critique of Two Password Managers , 2006, USENIX Security Symposium.