Cost-effective computer security: cognitive and associative passwords

Podd, John; Bunnell, Julie; Henderson, Ronald D.

doi:10.1109/ozchi.1996.560026

Cited by 15 publications

(14 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Podd et al conducted a similar study in 1996, and found similar recall rates (80%) and higher guessing rates (39.5%) [10]. They, too, focused on partners who were significant others.…”

Section: Background and Related Workmentioning

confidence: 87%

“…In two different studies, one in 1990 [17] and another in 1996 [10], participants were asked personal authentication questions and those they were close tospouses, family members, or close friends -were able to guess 33%-39% of their answers. These studies also addressed the memorability of questions; participants forgot 20%-22% of their own answers within three months.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

It's No Secret. Measuring the Security and Reliability of Authentication via Secret Questions

Schechter

Brush

Egelman

2009

2009 30th IEEE Symposium on Security and Privacy

111

View full text Add to dashboard Cite

All four of the most popular webmail providers -AOL, Google, Microsoft, and Yahoo! -rely on personal questions as the secondary authentication secrets used to reset account passwords. The security of these questions has received limited formal scrutiny, almost all of which predates webmail. We ran a user study to measure the reliability and security of the questions used by all four webmail providers. We asked participants to answer these questions and then asked their acquaintances to guess their answers. Acquaintances with whom participants reported being unwilling to share their webmail passwords were able to guess 17% of their answers. Participants forgot 20% of their own answers within six months. What's more, 13% of answers could be guessed within five attempts by guessing the most popular answers of other participants, though this weakness is partially attributable to the geographic homogeneity of our participant pool.

show abstract

“…Podd et al conducted a similar study in 1996, and found similar recall rates (80%) and higher guessing rates (39.5%) [10]. They, too, focused on partners who were significant others.…”

Section: Background and Related Workmentioning

confidence: 87%

Section: Introductionmentioning

confidence: 99%

It's No Secret. Measuring the Security and Reliability of Authentication via Secret Questions

Schechter

Brush

Egelman

2009

2009 30th IEEE Symposium on Security and Privacy

111

View full text Add to dashboard Cite

show abstract

“…Our findings suggest that, while the raw accuracy varies for different question types, the model-based accuracy of the presented system exceeds the accuracy of static challenge question based systems significantly, and is also harder to compromise by adversarial users (e.g., low guessability) [4,7,8,14].…”

Section: Discussion and Limitations Of The Studymentioning

confidence: 87%

Evaluating smartphone-based dynamic security questions for fallback authentication: a field study

Albayram

Khan

2016

Hum. Cent. Comput. Inf. Sci.

View full text Add to dashboard Cite

To address the limitations of static challenge question based fallback authentication mechanisms (e.g., easy predictability), recently, smartphone based autobiographical authentication mechanisms have been explored where challenge questions are not predetermined and are instead generated dynamically based on users’ day-to-day activities captured by smartphones. However, as answering different types and styles of questions is likely to require different amounts of cognitive effort and affect users’ performance, a thorough study is required to investigate the effect of type and style of challenge questions and answer selection mechanisms on users’ recall performance and usability of such systems. Towards that, this paper explores seven different types of challenge questions where different types of questions are generated based on users’ smartphone usage data. For evaluation, we conducted a field study for a period of 30 days with 24 participants who were recruited in pairs to simulate different kinds of adversaries (e.g., close friends, significant others). Our findings suggest that the question types do have a significant effect on user performance. Furthermore, to address the variations in users’ accuracy across multiple sessions and question types, we investigate and present a Bayesian classifier based authentication algorithm that can authenticate legitimate users with high accuracy by leveraging individual response patterns.

show abstract

“…They found that participants remembered 78% of their answers, but that significant others were able to guess 33% of their answers. Podd et al conducted a similar study in 1996, and found similar recall rates (80%) and higher guessing rates (39.5%) [9]. In 2008, Rabkin conducted a study of twenty bank websites that use personal questions as a backup authentication mechanism.…”

Section: Backup Authentication Using Personal Questionsmentioning

confidence: 94%

“…For personal questions, prior and concurrent research has shown that users forget their answers and their acquaintances may be able to guess them [14,9,12]. An account holder who tries to authenticate via an alternate email address may find that the configured address expired upon a change of job, school, or Internet service provider.…”

Section: Introductionmentioning

confidence: 99%

It's not what you know, but who you know

Schechter

Egelman

Reeder

2009

Proceedings of the SIGCHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

Backup authentication mechanisms help users who have forgotten their passwords regain access to their accounts-or at least try. The security and reliability of today's backup authentication mechanisms have significant room for improvement. We designed, built, and tested a new authentication system that employs social-authentication. The system employs trustees previously appointed by the account holder to verify the account holder's identity. We ran three experiments to determine whether the system could (1) reliably authenticate account holders, (2) resist email attacks that target trustees by impersonating account holders, and (3) resist phone-based attacks from individuals close to account holders. Results were encouraging: seventeen of the nineteen participants who made the effort to call trustees authenticated successfully. However, we also found that users must be reminded of who their trustees are. While email-based attacks were largely unsuccessful, stronger countermeasures will be required to counter highly-personalized phone-based attacks.

show abstract

Cost-effective computer security: cognitive and associative passwords

Cited by 15 publications

References 6 publications

It's No Secret. Measuring the Security and Reliability of Authentication via Secret Questions

It's No Secret. Measuring the Security and Reliability of Authentication via Secret Questions

Evaluating smartphone-based dynamic security questions for fallback authentication: a field study

It's not what you know, but who you know

Contact Info

Product

Resources

About

Cost-effective computer security: cognitive and associative passwords

Cited by 15 publications

References 6 publications

It's No Secret. Measuring the Security and Reliability of Authentication via &#147;Secret&#148; Questions

It's No Secret. Measuring the Security and Reliability of Authentication via &#147;Secret&#148; Questions

Evaluating smartphone-based dynamic security questions for fallback authentication: a field study

It's not what you know, but who you know

Contact Info

Product

Resources

About

It's No Secret. Measuring the Security and Reliability of Authentication via Secret Questions

It's No Secret. Measuring the Security and Reliability of Authentication via Secret Questions