A Simple and Secure Reformation-Based Password Scheme

Abstract

The electronic applications of financial institutions like banks and insurance companies use either token-based, biometric-based, or knowledge-based password scheme to keep the confidential information of their customers safe from hackers. The knowledge-based password scheme's resistance, particularly its reformation-based password scheme against shoulder surfing attacks, is comparatively better than the other two because its password can be entered in crowded places without fear of shoulder surfers. However, the available reformation based passwords involve mental computation making their usability difficult. Furthermore, they also need an extra device like earphones during password entry causing to create a gap for information leakage. Moreover, most of the passwords store passwords' actual content on a server database that causes penetration in the financial institutions' database. In this article, a reformation-based password scheme involving no mental computation and using no extra device is proposed. The proposed scheme works on the password characters' indices, which change dynamically after each login process. It gets the password characters' indices from the end-user and obtains his password characters' indices from the database. Next, the textual passwords are formed from the user-provided indices and those obtained from the database. The textual passwords are then compared, and if found match, then login is succeeded, otherwise failed. Our proposed password scheme's experimental results on the password data set showed better security and usability compared to state-of-art password schemes.

Usable Security: A Systematic Literature Review

“…Usability evaluation of existing and novel systems: Contributions belonging to this category seem to be characterized by two main approaches to evaluating the products/methods: authors either evaluate them individually [20,25,27,29,[34][35][36][37] or compare them with other existing or new systems [4,[13][14][15][16][17][18][19]22,24,26,28,30,32,33,[38][39][40][41].…”

“…Another critical issue shared by many articles belonging to this cluster is the creation and use of custom measures to evaluate the usability of the products and systems studied, such as code length [15] or typing effort [39], exclusively related to the specific tool used. This highlights a methodological weakness, forgoing the golden standards for usability assessment and making the studies often not comparable.…”

Usability and Security of Knowledge-based Authentication Systems: A State-of-the-Art Review

“…The knowledge-based password still provides extendable usability and security features. It can be comparable to the token and biometrics security levels with respect to mitigating most of the usability issues and security threats [1], [109]. Textual passwords are relatively still the most usable passwords because their ease of use, lack of hardware required, and less required storage [110].…”

“…The biggest challenge for several companies is to establish an authentication technique that offers a high level of usability and security. Authentication systems can be classified into three main types: knowledge-based, token-based, and biometric [1], [2]. Large corporations and banks have recently switched to the use of biometrics or token passwords to verify individuals' identities, but these passwords require expensive hardware and high-complexity algorithms [3]- [5].…”

IoT Devices Authentication Using Artificial Neural Network

“…Shoulder surfing being a real threat to authentication systems is of two types, i.e., weak and strong shoulder surfing attacks. In the first one, an attacker directly observes the authentication mechanism, whereas in the latter one, the attacker uses any hardware device, i.e., recording camera [35]. Textual passwords are slightly unprotected and are easily attackable that's why they are considered to be the weakest link in authentication chain [36,37].…”