Pass-sentence— a new approach to computer code

Spector, Yishay; Ginzberg, Jacob

doi:10.1016/0167-4048(94)90064-7

Cited by 34 publications

(14 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Human cognition has been investigated intensely with the goal to enhance recall of passwords e.g., cognitive passwords [38], word associations [27], pass phrases [28], images [11], or pass faces [3]. None of this work considered cognitive capabilities and limitations in the context of PIN or password entry.…”

Section: Related Workmentioning

confidence: 99%

A PIN-entry method resilient against shoulder surfing

Röth¹,

Richter

Freidinger

2004

Proceedings of the 11th ACM Conference on Computer and Communications Security

217

138

View full text Add to dashboard Cite

Magnetic stripe cards are in common use for electronic payments and cash withdrawal. Reported incidents document that criminals easily pickpocket cards or skim them by swiping them through additional card readers. Personal identification numbers (PINs) are obtained by shoulder surfing, through the use of mirrors or concealed miniature cameras. Both elements, the PIN and the card, are generally sufficient to give the criminal full access to the victim's account. In this paper, we present alternative PIN entry methods to which we refer as cognitive trapdoor games. These methods make it significantly harder for a criminal to obtain PINs even if he fully observes the entire input and output of a PIN entry procedure. We also introduce the idea of probabilistic cognitive trapdoor games, which offer resilience to shoulder surfing even if the criminal records a PIN entry procedure with a camera. We studied the security as well as the usability of our methods, the results of which we also present in the paper.

show abstract

Section: Related Workmentioning

confidence: 99%

A PIN-entry method resilient against shoulder surfing

Röth¹,

Richter

Freidinger

2004

Proceedings of the 11th ACM Conference on Computer and Communications Security

217

138

View full text Add to dashboard Cite

show abstract

“…Pass-sentences and pass-phrases are textual passwords composed of long, grammatically correct phrases [29]. The personalized phrases are memorable, and their length resists software cracking.…”

Section: Alternative Textual Password Schemesmentioning

confidence: 99%

Human selection of mnemonic phrase-based passwords

Kuo

Romanosky

Cranor

2006

Proceedings of the Second Symposium on Usable Privacy and Security - SOUPS '06

156

113

View full text Add to dashboard Cite

Textual passwords are often the only mechanism used to authenticate users of a networked system. Unfortunately, many passwords are easily guessed or cracked. In an attempt to strengthen passwords, some systems instruct users to create mnemonic phrase-based passwords. A mnemonic password is one where a user chooses a memorable phrase and uses a character (often the first letter) to represent each word in the phrase.In this paper, we hypothesize that users will select mnemonic phrases that are commonly available on the Internet, and that it is possible to build a dictionary to crack mnemonic phrase-based passwords. We conduct a survey to gather user-generated passwords. We show the majority of survey respondents based their mnemonic passwords on phrases that can be found on the Internet, and we generate a mnemonic password dictionary as a proof of concept. Our 400,000-entry dictionary cracked 4% of mnemonic passwords; in comparison, a standard dictionary with 1.2 million entries cracked 11% of control passwords. The usergenerated mnemonic passwords were also slightly more resistant to brute force attacks than control passwords. These results suggest that mnemonic passwords may be appropriate for some uses today. However, mnemonic passwords could become more vulnerable in the future and should not be treated as a panacea.

show abstract

“…• The pass sentence mechanism (Spector & Ginzberg, 1994) is an unaided recall mechanism in the first place. However, if the user does not get the secret completely right, the user is prompted with questions about the pass sentence.…”

Section: Alternative Knowledge-based Authentication Systemsmentioning

confidence: 99%

Transforming the 'Weakest Link' - a Human-Computer Interaction Approach to Usable and Effective security

Sasse

Brostoff²,

Weirich³

2002

Internet and Wireless Security

193

255

View full text Add to dashboard Cite

The security research community has recently recognised that user behaviour plays a part in many security failures, and it has become common to refer to users as the "weakest link in the security chain". We argue that simply blaming users will not lead to more effective security systems. Security designers must identify the causes of undesirable user behaviour, and address these to design effective security systems. We present examples of how undesirable user behaviour with passwords can be caused by failure to recognise the characteristics of human memory, unattainable or conflicting task demands, and lack of support, training and motivation. We conclude that existing Human-Computer Interaction (HCI) knowledge and techniques can be used to prevent or address these problems, and outline a vision of a holistic design approach for usable and effective security.

show abstract

Pass-sentence— a new approach to computer code

Cited by 34 publications

References 6 publications

A PIN-entry method resilient against shoulder surfing

A PIN-entry method resilient against shoulder surfing

Human selection of mnemonic phrase-based passwords

Transforming the 'Weakest Link' - a Human-Computer Interaction Approach to Usable and Effective security

Contact Info

Product

Resources

About