Abstract. Continuous stress monitoring may help users better understand their stress patterns and provide physicians with more reliable data for interventions. Previously, studies on mental stress detection were limited to a laboratory environment where participants generally rested in a sedentary position. However, it is impractical to exclude the effects of physical activity while developing a pervasive stress monitoring application for everyday use. The physiological responses caused by mental stress can be masked by variations due to physical activity. We present an activity-aware mental stress detection scheme. Electrocardiogram (ECG), galvanic skin response (GSR), and accelerometer data were gathered from 20 participants across three activities: sitting, standing, and walking. For each activity, we gathered baseline physiological measurements and measurements while users were subjected to mental stressors. The activity information derived from the accelerometer enabled us to achieve 92.4% accuracy of mental stress classification for 10-fold cross validation and 80.9% accuracy for between-subjects classification.

Textual passwords are often the only mechanism used to authenticate users of a networked system. Unfortunately, many passwords are easily guessed or cracked. In an attempt to strengthen passwords, some systems instruct users to create mnemonic phrase-based passwords. A mnemonic password is one where a user chooses a memorable phrase and uses a character (often the first letter) to represent each word in the phrase.In this paper, we hypothesize that users will select mnemonic phrases that are commonly available on the Internet, and that it is possible to build a dictionary to crack mnemonic phrase-based passwords. We conduct a survey to gather user-generated passwords. We show the majority of survey respondents based their mnemonic passwords on phrases that can be found on the Internet, and we generate a mnemonic password dictionary as a proof of concept. Our 400,000-entry dictionary cracked 4% of mnemonic passwords; in comparison, a standard dictionary with 1.2 million entries cracked 11% of control passwords. The usergenerated mnemonic passwords were also slightly more resistant to brute force attacks than control passwords. These results suggest that mnemonic passwords may be appropriate for some uses today. However, mnemonic passwords could become more vulnerable in the future and should not be treated as a panacea.

Phishing, or web spoofing, is a growing problem: the Anti-Phishing Working Group (APWG) received almost 14,000 unique phishing reports in August 2005, a 56% jump over the number of reports in December 2004 [3]. $150,000 [17]. For financial institutions, phishing is a particularly insidious problem, since trust forms the foundation for customer relationships, and phishing attacks undermine confidence in an institution. Phishing attacks succeed by exploiting a user's inability to distinguish legitimate sites from spoofed sites. Prior research focuses on assisting the user in making this distinction, but they require the user to make the right security decision every time. A single mistake results in a total compromise of the user's online account. Unfortunately, humans are ill-suited for performing the security checks necessary for secure authentication. Fundamentally, users should be authenticated using information that they cannot readily reveal to malicious parties. Our system eliminates reliance on perfect user behavior and protects a user's account even in the presence of keyloggers and other forms of spyware. We demonstrate the practicality of our system with a working prototype. Ultimately, placing less reliance on the user during the authentication process will enhance security and eliminate many forms of fraud.

No abstract