Integrating Visual Mnemonics and Input Feedback With Passphrases to Improve the Usability and Security of Digital Authentication

Abstract

Objective:

We developed a new authentication system based on passphrases instead of passwords. Our new system incorporates a user-generated mnemonic picture displayed during login, definition tooltips, error correction to reduce typographical errors, a decoy-based input masking technique, and random passphrase generation using either a specialized wordlist or a sentence template.

Background:

Passphrases exhibit a greater level of security than traditional passwords, but their wider adoption has been hindered by human factors issues. Our assertion is that the added features of our system work particularly well with passphrases and help address these shortcomings.

Method:

We conducted a study to evaluate our new system with a customized 1,450-word list and our new system with a 6-word sentence structure against the control conditions of a user-created passphrase of at least 24 characters and a system-generated passphrase using a 10,326-word list. Fifty participants completed two sessions so that we could measure the usability and security of the authentication schemes.

Results:

With the new system conditions, memorability was improved, and security was equivalent to or better than the control conditions. Usability and overall ratings also favored the new system conditions over the control conditions.

Conclusion:

Our research presents a new authentication system using innovative techniques that improve on the usability and security of existing password and passphrase authentication systems.

Application:

In computer security, drastic changes should never happen overnight, but we recommend that our contributions be incorporated into current authentication systems to help facilitate a transition from passwords to usable passphrases.

Keywords

cybersecurity usability passwords passphrases mnemonics

Get full access to this article

View all access options for this article.

References

Bertsch

Pesta

B. J.

Wiscott

McDaniel

M. A

. (2007). The generation effect: A meta-analytic review. Memory & Cognition, 35(2), 201–210.

Biancuzzi

. (2006, February 22). John the Ripper 1.7, by Solar Designer. Retrieved from http://www.securityfocus.com/columnists/388/2

Brooke

. (1996). SUS: A “quick and dirty” usability scale. In Jordan

P. W.

Thomas

Weerdmeester

B. A.

McClelland

A. L.

(Eds.), Usability evaluation in industry (pp. 189–194). London: Taylor and Francis.

Burr

W. E.

Dodson

D. F.

Polk

W. T

. (2006). Electronic authentication guideline: Recommendations of the National Institute of Standards and Technology. Gaithersburg, MD: U.S. Department of Commerce, Technology Administration, National Institute of Standards and Technology.

Craik

F. I. M.

Tulving

. (1975). Depth of processing and the retention of words in episodic memory. Journal of Experimental Psychology: General, 104(3), 268–294.

Fraune

M. R.

Juang

K. A.

Greenstein

J. S.

Chalil Madathil

Koikkara

. (2013). Employing user-created pictures to enhance the recall of system-generated mnemonic phrases and the security of passwords. Proceedings of the 57th Annual Meeting of the Human Factors and Ergonomics Society (pp. 419–423). Santa Monica, CA: Human Factors and Ergonomics Society.

Hart

S. G.

Staveland

. (1988). Development of NASA-TLX: Results of empirical and theoretical research. In Hancock

P. A.

Meshkati

(Eds.), Human mental workload (pp. 239–250). Amsterdam, Netherlands: North-Holland Press.

Herley

van Oorschot

P. C

. (2012). A research agenda acknowledging the persistence of passwords. IEEE Security & Privacy, 10(1), 28–36.

Hruska

. (2011, November 3). How to calculate password strength. Retrieved from http://cubicspot.blogspot.com/2011/11/how-to-calculate-password-strength.html

10.

Juang

K. A.

Greenstein

J. S

. (2011). Evaluating the usability and security of input masking techniques. Proceedings of the 55th Annual Meeting of the Human Factors and Ergonomics Society (pp. 1120–1124). Santa Monica, CA: Human Factors and Ergonomics Society.

11.

Juang

K. A.

Ranganayakulu

Greenstein

J. S

. (2012). Using system-generated mnemonics to improve the usability and security of password authentication. Proceedings of the 56th Annual Meeting of the Human Factors and Ergonomics Society (pp. 506–510). Santa Monica, CA: Human Factors and Ergonomics Society.

12.

Keith

Shao

Steinbart

P. J

. (2007). The usability of passphrases for authentication: An empirical field study. International Journal of Human-Computer Studies, 65(1), 17–28.

13.

Kelley

P. G.

Komanduri

Mazurek

M. L.

Shay

Vidas

Bauer

. . . Lopez

. (2012). Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. Proceedings of the 2012 IEEE Symposium on Security and Privacy (pp. 523–537). Piscataway, NJ: IEEE.

14.

Kelly

. (2010). VOA Special English word book. Retrieved from http://www.manythings.org/voa/words.htm

15.

Komanduri

Shay

Kelley

P. G.

Mazurek

M. L.

Bauer

Christin

Egelman

. (2011). Of passwords and people: Measuring the effect of password-composition policies. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 2595–2604). New York, NY: ACM.

16.

Kuo

Romanosky

Cranor

L. F

. (2006). Human selection of mnemonic phrase-based passwords. Proceedings of the Second Symposium on Usable Privacy and Security (pp. 67–78). New York, NY: ACM.

17.

Leonhard

M. D.

Venkatakrishnan

V. N

. (2007). A comparative study of three random password generators. IEEE International Conference on Electro/Information Technology 2007 (pp. 227–232). Piscataway, NJ: IEEE.

18.

Percival

. (2009). Stronger key derivation via sequential memory-hard functions. Proceedings of BSDCan 2009 (pp. 1–16). Ottawa: BSDCan.

19.

Proctor

R. W.

Lien

M. C.

K. P. L.

Schultz

E. E.

Salvendy

. (2002). Improving computer security for authentication of users: Influence of proactive password restrictions. Behavior Research Methods, Instruments & Computers, 34(2), 163–169.

20.

Rao

Jha

Kini

. (2013). Effect of grammar on security of long passwords. Proceedings of the Third ACM Conference on Data and Application Security and Privacy (pp. 317–324). New York, NY: ACM.

21.

Reinhold

. (2012). The Diceware passphrase home page. Retrieved from http://world.std.com/~reinhold/diceware.html

22.

Renaud

. (2005). Evaluating authentication mechanisms. In Cranor

L. F.

Garfinkel

(Eds.), Security and usability (pp. 103–128). Sebastopol, CA: O’Reilly.

23.

Shay

Kelley

P. G.

Komanduri

Mazurek

M. L.

Vidas

. . . Cranor

L. F

. (2012). Correct horse battery staple: Exploring the usability of system-assigned passphrases. Proceedings of the Eighth Symposium on Usable Privacy and Security (Article No. 7). New York, NY: ACM.

24.

Shiner

. (2013). On hashcat and strong master passwords as your best protection. Retrieved from http://blog.agilebits.com/2013/04/16/1password-hashcat-strong-master-passwords/

25.

Whitten

Tygar

J. D

. (1999). Why Johnny can’t encrypt: A usability evaluation of PGP 5.0. Proceedings of the 8th USENIX Security Symposium (pp. 169–184). Retrieved from https://www.usenix.org/conference/8th-usenix-security-symposium/why-johnny-cant-encrypt-usability-evaluation-pgp-50

26.

Winkler

W. E

. (1990). String comparator metrics and enhanced decision rules in the Fellegi-Sunter model of record linkage. Proceedings of the Section on Survey Research Methods (pp. 354–359). Alexandria, VA: American Statistical Association.

27.

Yan

Blackwell

Anderson

Grant

. (2004). Password memorability and security: Empirical results. IEEE Security & Privacy, 2(5), 25–31.