The usability of passphrases for authentication: An empirical field study

Keith, Mark J.; Shao, Benjamin B. M.; Steinbart, Paul John

doi:10.1016/j.ijhcs.2006.08.005

Cited by 98 publications

(100 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Keith at al [7] presented an empirical study based on the usability of passphrases after a 12 week long experiment. Campbell et al [8] proved that enforcing good password composition rules does not discourage users from setting strong and meaningful passwords.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Password Security: An Analysis of Password Strengths and Vulnerabilities

Chanda¹

2016

IJCNIS

View full text Add to dashboard Cite

Abstract-Passwords can be used to gain access to specific data, an account, a computer system or a protected space. A single user may have multiple accounts that are protected by passwords. Research shows that users tend to keep same or similar passwords for different accounts with little differences. Once a single password becomes known, a number of accounts can be compromised. This paper deals with password security, a close look at what goes into making a password strong and the difficulty involved in breaking a password. The following sections discuss related work and prove graphically and mathematically the different aspects of password securities, overlooked vulnerabilities and the importance of passwords that are widely ignored. This work describes tests that were carried out to evaluate the resistance of passwords of varying strength against brute force attacks. It also discusses overlooked parameters such as entropy and how it ties in to password strength. This work also discusses the password composition enforcement of different popular websites and then presents a system designed to provide an adaptive and effective measure of password strength. This paper contributes toward minimizing the risk posed by those seeking to expose sensitive digital data. It provides solutions for making password breaking more difficult as well as convinces users to choose and set hard-to-break passwords.

show abstract

Section: Related Workmentioning

confidence: 99%

“…If it were made of upper and lower case characters then the character set size would be 52 and the possibilities would be 52 6 , which is 1.9770 x 10 10 . If the password size is 7 then the possibilities would become 26 7 and 52 7 .…”

Section: Password Strengthmentioning

confidence: 99%

Password Security: An Analysis of Password Strengths and Vulnerabilities

Chanda¹

2016

IJCNIS

View full text Add to dashboard Cite

show abstract

“…Specific usability studies of passphrases [11] have found them to be just as memorable as passwords, subject to an increased rate of typographical errors. Several proposals have been made reduce the rate of errors, either by storing multiple hashes of a passphrase to recognise entry of nearly-correct strings [16,2] or by providing visual feedback to allow a user to notice typos when they are made [18].…”

Section: Introductionmentioning

confidence: 99%

“…The few published usability studies of passphrases estimate security either by naive calculations of the total space of possible character strings [11] or rely on Shannon's decades-old estimates of the entropy of characters in English text [20]. Experience from password guessing suggests that the only valid methods of estimating security of human-chosen secrets like passphrases are to run cracking software against real choices [17] or to collect sufficient data that the frequency of common choices can be predicted statistically [3].…”

Section: Introductionmentioning

confidence: 99%

Linguistic Properties of Multi-word Passphrases

Bonneau

Shutova

2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We examine patterns of human choice in a passphrase-based authentication system deployed by Amazon, a large online merchant. We tested the availability of a large corpus of over 100,000 possible phrases at Amazon's registration page, which prohibits using any phrase already registered by another user. A number of large, readily-available lists such as movie and book titles prove effective in guessing attacks, suggesting that passphrases are vulnerable to dictionary attacks like all schemes involving human choice. Extending our analysis with natural language phrases extracted from linguistic corpora, we find that phrase selection is far from random, with users strongly preferring simple noun bigrams which are common in natural language. The distribution of chosen passphrases is less skewed than the distribution of bigrams in English text, indicating that some users have attempted to choose phrases randomly. Still, the distribution of bigrams in natural language is not nearly random enough to resist offline guessing, nor are longer three-or fourword phrases for which we see rapidly diminishing returns.

show abstract

“…User compliance, requires a feat of human memory that flies in the face of the limits of human cognition. Techniques users can adopt for memorising these seemingly unmemorable passwords include mnemonics [29] and passphrases [16], while alternative approaches to passwords include cognitive [30] and associative passwords [23]. Technical solutions to the problem also exist in the form of Single Signon (SSO) password managers [4].…”

Section: Introductionmentioning

confidence: 99%

Securing passfaces for description

Dunphy

Nicholson

Olivier

2008

Proceedings of the 4th Symposium on Usable Privacy and Security

View full text Add to dashboard Cite

One common practice in relation to alphanumeric passwords is to write them down or share them with a trusted friend or colleague. Graphical password schemes often claim the advantage that they are significantly more secure with respect to both verbal disclosure and writing down. We investigated the reality of this claim in relation to the Passfaces graphical password scheme. By collecting a corpus of naturalistic descriptions of a set of 45 faces, we explored participants' ability to associate descriptions with faces across three conditions in which the decoy faces were selected: (1) at random; (2) on the basis of their visual similarity to the target face; and (3) on the basis of the similarity of the verbal descriptions of the decoy faces to the target face. Participants were found to perform significantly worse when presented with visual and verbally grouped decoys, suggesting that Passfaces can be further secured for description. Subtle differences in both the nature of male and female descriptions, and male and female performance were also observed.

show abstract

The usability of passphrases for authentication: An empirical field study

Cited by 98 publications

References 29 publications

Password Security: An Analysis of Password Strengths and Vulnerabilities

Password Security: An Analysis of Password Strengths and Vulnerabilities

Linguistic Properties of Multi-word Passphrases

Securing passfaces for description

Contact Info

Product

Resources

About