Employing User-Created Pictures to Enhance the Recall of System-Generated Mnemonic Phrases and the Security of Passwords

Abstract

User-created passwords are typically higher in usability but lower in security than computer-generated passwords. This study evaluates the usability and security of a password scheme in which users are assigned computer-generated random passwords and corresponding computer-generated mnemonic phrases. Users created images that matched the phrases to cue password recall at the time of login. Different picture creation methods (drawing, online images, and a combination of both) and a control condition (no picture) were used to examine the effects of picture creation method on password memorability. Login success was measured the day of account creation and after approximately one week. To measure security during the second session, participants were also asked to simulate attackers by attempting to derive others' passwords from viewing their images. Analysis revealed that pictures enhanced password memorability but picture creation method had no effect on password memorability. There were no significant differences in security across the four conditions.

Integrating Visual Mnemonics and Input Feedback With Passphrases to Improve the Usability and Security of Digital Authentication

“…The generation effect demonstrates that creating cues oneself rather than combining pieces of information together can increase recall (Craik & Tulving, 1975). Because the generation effect works only for the person who created the picture (Bertsch, Pesta, Wiscott, & McDaniel, 2007), our method should improve password recall while maintaining the same level of security, which was supported by the findings of Fraune et al (2013).…”

“…These are implemented as tooltips that appear when the word is hovered over. Another one of the contributions from our previous work is the use of user-created mnemonic pictures to facilitate password memorization (Fraune et al, 2013), as shown in Figure 2. During account creation, when a randomly generated passphrase is displayed, a simple paint program is also opened by the system.…”

“…Our goal was to develop a new system-generated passphrase authentication system that incorporated the three major contributions from our previous work: a specialized wordlist and sentence template (Juang et al, 2012), a user-created mnemonic picture that provides cued recall (Fraune et al, 2013), and a decoy-based input masking technique (Juang & Greenstein, 2011). Along with word definition tooltips and error correction (also known as autocorrect) to reduce typographical errors, we expected that this new system would prove particularly well suited to passphrases.…”

“…Shay et al (2012) recommended that perhaps the most promising area for improving memorability of passphrases lies in asking users to construct a scene or story relating to their passphrase. Fraune, Juang, Greenstein, Chalil Madathil, and Koikkara (2013) found that asking users to create a mnemonic picture to assist them with system-generated passphrases did improve the level of usability of those passphrases.…”

“…This chapter is based on previously published work (Fraune, Juang, Greenstein, Chalil Madathil, & Koikkara, 2013).…”