pASSWORD tYPOS and How to Correct Them Securely

Chatterjee, Rahul; Athayle, Anish; Akhawe, Devdatta; Juels, Ari; Ristenpart, Thomas

doi:10.1109/sp.2016.53

Cited by 50 publications

(53 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This may indicate that shorter passwords might be more manageable for children (albeit at a decrease in security). Alternatively, a system which accepts entries as correct if they meet a certain threshold may also be conceivable, which aligns with Chatterjee et al's [30] typo-tolerant password authentication framework.…”

Section: R1 Facilitate Memorization Through Learning and Training Fementioning

confidence: 68%

An exploration of graphical password authentication for children

Assal

Imran

Chiasson

2018

International Journal of Child-Computer Interaction

View full text Add to dashboard Cite

In this paper, we explore graphical passwords as a child-friendly alternative for user authentication. We evaluate the usability of three variants of the PassTiles graphical password scheme for children, and explore the similarities and differences in performance and preferences between children and adults while using these schemes. Children were most successful at recalling passwords containing images of distinct objects. Both children and adults prefer graphical passwords to their existing schemes, but password memorization strategies differ considerably between the two groups. Based on our findings, we provide recommendations for designing more child-friendly authentication schemes.

show abstract

Section: R1 Facilitate Memorization Through Learning and Training Fementioning

confidence: 68%

An exploration of graphical password authentication for children

Assal

Imran

Chiasson

2018

International Journal of Child-Computer Interaction

View full text Add to dashboard Cite

show abstract

“…To allow for a direct comparison, our work follows the formalization of a password authentication system proposed in [12], and also applies the same model for evaluating security loss in the presence of a bruteforce attacker. To begin with, we review some of the important concepts and notations.…”

Section: Server Side Typo-tolerant Checking Schemementioning

confidence: 99%

“…The construction of such an optimal attacker is NPhard. However, in [12], the authors proposed a greedy algorithm to realize this attacker in practice. As a result, the security loss caused by such a greedy attacker against a relaxed checker can be calculated by ∆…”

Section: System Modelmentioning

confidence: 99%

“…While the first systematic work of password autocorrection appears in [12], it is implemented on the server-side with the purpose of increasing the password acceptance rate. The authors found that almost 10% of failed login attempts are caused by simple, easily correctable typos that should otherwise be accepted.…”

Section: Introductionmentioning

confidence: 99%

“…Based on it, we developed a new set of password correctors, which differ from the previous work [12] and cover 26.3% more typos. To achieve the second goal, we designed VaultIME to be compatible with the free auto-correction theory of [12], which states that with a certain filter policy, auto-correction introduces zero security loss. To measure the security loss, we ran simulation attacks to our auto-correction scheme.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

VaultIME: Regaining User Control for Password Managers through Auto-correction

Guan¹,

Farhang²,

Pu³

et al. 2018

ICST Transactions on Security and Safety

View full text Add to dashboard Cite

Users are often educated to follow advices from security experts. For example, using a password manager is considered an effective way to maintain a unique and strong password for every website. However, user surveys reveal that most users are not willing to adopt this tool. They feel uncomfortable when they grant password managers the privilege to automate access to their digital accounts. We propose VaultIME to nudge more users towards the adoption of password managers by offering them a tangible benefit, while only slightly interfering with their current usage practices. Instead of "auto-filling" password fields, we propose to "autocorrect" passwords in case of minor typos. VaultIME integrates the functionality of a password manager into the input method editor. Running as an app on mobile phones, VaultIME remembers user passwords on a per-app basis, and corrects mistyped passwords within a typo-tolerant set. We show that VaultIME achieves high levels of usability and security.

show abstract