Employing User-Created Pictures to Enhance the Recall of System-Generated Mnemonic Phrases and the Security of Passwords

Abstract

User-created passwords are typically higher in usability but lower in security than computer-generated passwords. This study evaluates the usability and security of a password scheme in which users are assigned computer-generated random passwords and corresponding computer-generated mnemonic phrases. Users created images that matched the phrases to cue password recall at the time of login. Different picture creation methods (drawing, online images, and a combination of both) and a control condition (no picture) were used to examine the effects of picture creation method on password memorability. Login success was measured the day of account creation and after approximately one week. To measure security during the second session, participants were also asked to simulate attackers by attempting to derive others’ passwords from viewing their images. Analysis revealed that pictures enhanced password memorability but picture creation method had no effect on password memorability. There were no significant differences in security across the four conditions.

Get full access to this article

View all access options for this article.

References

Bertsch

Pesta

B. J.

Wiscott

McDaniel

M. A.

(2007). The generation effect: A meta-analytic review. Memory & Cognition, 35(2), 201-210.

Brooke

(1996). SUS: a “quick and dirty” usability scale. In Jordan

P. W.

Thomas

Weerdmeester

B. A.

McClelland

A. L.

(Eds.), Usability Evaluation in Industry (pp. 189-194). London: Taylor and Francis

Craik

F. I. M.

Tulving

(1975). Depth of processing and the retention of words in episodic memory. Journal of Experimental Psychology: General, 104(3), 268-294.

Damerau

(1964). A technique for computer detection and correction of spelling errors. Communications of the ACM, 7(3), 171-176.

De Angeli

Coventry

Johnson

Renaud

(2005). Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems. Int. J. Human-Computer Studies, 63, 128-152.

Forget

Chiasson

van Oorschot

P. C.

Biddle

(2008). Persuasion for stronger passwords: Motivation and pilot study. Proceedings of the International Conference on Persuasive Technology, 140-150.

Goverover

Basso

Wood

Chiaravalloti

DeLuca

(2011). Examining the benefits of combining two learning strategies on recall of functional information in persons with multiple sclerosis. Multiple Sclerosis Journal, 17(12), 1488-1497.

Greenwald

A. G.

Banaji

M. R.

(1989). The self as a memory system: Powerful, but ordinary. Journal of Personality and Social Psychology, 57(1), 41-54.

Hart

S. G.

Staveland

(1988). Development of NASA-TLX: Results of empirical and theoretical research. In Hancock

P. A.

Meshkati

(Eds.), Human Mental Workload (pp. 239-250). Amsterdam: North-Holland Press

10.

Hayashi

Hong

J. I.

Christin

(2011). Security through a different kind of obscurity: Evaluating distortion in graphical authentication schemes. Proceedings of the 2011 Annual Conference on Human Factors in Computing Systems, 2055-2064.

11.

Herley

van Oorschot

P. C.

(2012). A research agenda acknowledging the persistence of passwords. IEEE Security & Privacy, 10(1), 28-36.

12.

Ishihara

(1987). Ishihara’s tests for color-blindness (1st ed.). Tokyo, Japan: Kanehara & Co., Ltd.

13.

Juang

K. A.

Ranganayakulu

Greenstein

J. S.

(2012). Using systemgenerated mnemonics to improve the usability and security of password authentication. Proceedings of the 56th Annual Meeting of the Human Factors and Ergonomics Society, 506-510.

14.

Kuo

Romanosky

Cranor

L. F.

(2006). Human selection of mnemonic phrase-based passwords. In proceedings of the Symposium on Usable Privacy and Security, paper 36.

15.

Mäntylä

(1986). Optimizing cue effectiveness: Recall of 500 and 600 incidentally learned words. Journal of Experimental Psychology: Learning, Memory, and Cognition, 12(1), 66-71.

16.

Nelson

K. L.

(2010). Effectiveness of image-based mnemonic techniques for enhancing the memorability and security of usergenerated passwords. Computers in Human Behavior, 26, 705-715.

17.

Rogers

T. B.

Kuiper

N. A.

Kirker

W. S.

(1977). Self-reference and the encoding of personal information. Journal of Personality and Social Psychology, 35(9), 667-688.

18.

Slamecka

N. J.

Graf

(1978). The generation effect: Delineation of a phenomenon. Journal of Experimental Psychology: Human Learning and Memory, 4(6), 592-604.

19.

Tambascia

C. A.

Menezes

E. M.

Duarte

R. E.

(2011). Usability evaluation using eye tracking for iconographic authentication on mobile devices. Proceedings of Mobility 2011: The First International Conference on Mobile Services, Resources, and Users, 117-122.

20.

K. L.

Proctor

R. W.

Bhargav-Spantzel

Tai

B. B.

Cook

Schultz

(2007). Improving password security and memorability to protect personal and organizational information. International Journal of Human-Computer Studies, 65(8), 744-757.

21.

Winkler

W. E.

(1990). String comparator metrics and enhanced decision rules in the Fellegi-Sunter model of record linkage. Proceedings of the Section on Survey Research Methods, 354-359.