Learning System-assigned Passwords (up to 56 Bits) in a Single Registration Session with the Methods of Cognitive Psychology

Abstract

System-assigned random passwords offer security guarantees against guessing attacks but suffer from poor memorability. In this work, we review the cognitive psychology literature and identify two training methods appropriate to aid users in memorizing system-assigned passwords. The method of loci exploits users' spatial and visual memory, while the link method helps users by creating a chain of memory cues. We developed techniques to automatically take a given random password and generate training aids (videos) based on each of these methods. The results of a memorability study showed that both methods were significantly better than a control condition (no training) and that the method of loci had a login success rate of 86%, a high value for any recall-based study with system-assigned passwords. With a registration time of 160 seconds and a median login time of 9 seconds, this method holds promise as a direction to addressing the usability-security trade-off in user authentication. We further extend this idea to help users memorize long system-assigned random passwords that offer almost crypto-level security and conduct a second memorability study. The results of this study demonstrated that with the help of a password hint, 81% of participants were able to recall the password after a week. This indicates that the method of loci can be leveraged to help users memorize cryptographically-strong secret in just one session, and thus offers a more viable alternative to the spaced repetition technique, which involves dozens of sessions of user training. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Surviving in the digital environment: Does survival processing provide an additional memory benefit to password generation strategies?

“…The tendency to retain the gist of the password when using the PAO strategy is striking considering that password recall is typically quite low. Additionally, note that the recall rates obtained in this study were higher than those utilizing different strategies at similar delays (e.g., Haque, Al-Ameen, Wright, & Scielzo, 2017).…”

Investigating the Third Dimension for Authentication in Immersive Virtual Reality and in the Real World

“…Thus, after the cue-recall round, there were still twentyone participants who memorized their passwords correctly. Observations on Memory Techniques and Password Choices: Based on additional questions that we asked at the end of the questionnaire we made the following observations: (1) Without nudging participants to use specific memory techniques, they naturally used the link technique [12]. Overall passwords showed the tendency to tell a story, such that the choice of 'chips' and 'water' objects can be interpreted as 'I am eating chips, I am thirsty.'.…”

“…Taiabul et al [12] tested two memory techniques in virtual environments: the method of loci and the link method. Both leverage spatial memory which supports humans in recording their surroundings, forming spatial orientation and awareness [4,19,21].…”

A Practical Scheme to Improve Memorability of System-assigned Random Password

“…The demographic of participants are already discussed previously and shown in Table 6. The results show that the proposed method helps users remember graphical passwords (combination of alphanumeric and special characters) with high accuracy (more than 90%), where the state-of-the-art method can only achieve similar outcomes considering only alphanumeric characters and ignoring character cases or special characters [27].…”