The usability of passphrases for authentication: An empirical field study

International Journal of Human Computer Studies

Volumn 65, Issue 1, 2007, Pages 17-28

  Keith, Mark ^a   Shao, Benjamin ^a   Steinbart, Paul John ^a  

^a ARIZONA STATE UNIVERSITY   (United States)

Author keywords

Authentication; Memory; Passphrases; Passwords; Security; Usability

Indexed keywords

BIT ERROR RATE; COMPUTER CRIME; MANAGERS; PUBLIC POLICY; SECURITY OF DATA; USER INTERFACES;

AUTHENTICATION; MEMORABILITY; PASSPHRASES; PASSWORDS; USABILITY;

HUMAN COMPUTER INTERACTION;

EID: 33751168960     PISSN: 10715819     EISSN: 10959300     Source Type: Journal    
DOI: 10.1016/j.ijhcs.2006.08.005     Document Type: Article

References (39)

1. Adams D.A., Nelson R.R., and Todd P.A. Perceived usefulness, ease of use, and usage of information technology: a replication. MIS Quarterly 16 2 (1992) 227-247
2. Adams A., and Sasse M. Users are not the enemy. Communications of the ACM 42 12 (1999) 41-46
3. Baddeley A.D. Short-term memory for word sequences as a function of acoustic, semantic, and formal similarity. Quarterly Journal of Experimental Psychology 18 (1966) 362-365
4. Baddeley A.D. The magical number seven: still magical after all these years?. Psychological Review 101 2 (1994) 353-356
5. Bunnell J., Podd J., Henderson R., Napier R., and Kennedy-Moffat J. Cognitive, associative and conventional password: recall and guessing rates. Computers and Security 16 7 (1997) 645-657
6. Cameron K.A., Haarmann H.J., Grafman J., and Ruchkin D.S. Long-term memory is the representational basis for semantic verbal short-term memory. Psychophysiology 42 (2005) 643-653
7. Craik F.I.M. Two components in free recall. Journal of Verbal Learning and Verbal Behavior 7 (1968) 996-1004
8. Davis F.E. Perceived usefulness, perceived ease of use, and user acceptance of information technology. MIS Quarterly 13 3 (1989) 319-340
9. DeSanctis G. Computer graphics as decision aids: directions for research. Decision Sciences 15 4 (1984) 463-488
10. DeSanctis G., and Jarvenpaa S.L. Graphical presentation of accounting data for financial forecasting: an empirical investigation. Accounting Organizations and Society 14 5 & 6 (1989) 509-525
11. Doumont J. Magical numbers: the seven-plus-or-minus-two myth. IEEE Transactions on Professional Communication 45 2 (2002) 123-127
12. Federal Information Processing Standards Publication 112, 1985. Password Usage, National Institute of Standards and Technology, accessed July 19, 2005, available at 〈http://www.itl.nist.gov/fipspubs/fip112.htm〉.
13. Gong L., Lomas M.A., Needham R.M., and Saltzer J.H. Protecting poorly chosen secrets from guessing attacks. IEEE Journal on Selected Areas in Communications 11 5 (1993) 648-656
14. Highland J.H. Changing passwords. Computers and Security 16 3 (1997) 183-184
15. Ives B., Walsh K.R., and Schneider H. The domino effect of password reuse. Communications of the ACM 47 4 (2004) 75-78
16. Jeffries E., Ralph M.A.L., and Baddeley A.D. Automatic and controlled processing in sentence recall: the role of long-term and working memory. Journal of Memory and Language 51 (2004) 623-643
17. Johansson, J., 2004. The great debates: pass phrases vs. passwords. Part 1 of 3, Microsoft TechNet, 〈http://www.microsoft.com/technet/security/secnews/articles/itproviewpoint091004.mspx〉.
18. Johannson J.M., and Riley S. Protect Your Windows Network From Perimeter to Data (2005), Addison-Wesley, Upper Saddle River, NJ
19. Kling R. Learning about information technologies and social change: the contribution of social informatics. The Information Society 16 (2000) 217-232
20. Kurzban S.A. Easily remembered passphrases-a better approach. ACM SIGSAC Review 3 2-4 (1985) 10-21
21. Levenshtein V.I. Binary codes capable of correcting deletions, insertions, and reversals. Soviet Physics-Doklady 10 (1966) 707-710
22. McGraw, G., Viega, J., 2000. Protecting passwords: Part 2, IBM developerWorks, 〈http://www-128.ibm.com/developerworks/library/s-pass2/index.html#h4〉.
23. Miller G.A. The magical number seven, plus of minus two: some limits on our capacity for processing information. Psychological Review 63 (1956) 81-97
24. Morris R., and Thompson K. Password security: a case history. Communications of the ACM 22 11 (1979) 594-597
25. Novell, 2003. Eliminate security risks-reduce the costs of password management, Novell Nsure Solutions, 〈http://www.novell.com/collateral/4621367/4621367.pdf〉.
26. Okuda T., Tanaka E., and Kasa T. A method for the correction of garbled words based on the Levenshtein metric. IEEE Transactions on Computers 25 2 (1976) 172-178
27. Pond R., Podd J., Bunnell J., and Henderson R. Word association computer passwords: the effect of formulation techniques on recall and guessing rates. Computers and Security 19 7 (2000) 645-656
28. Porter S.N. A password extension for improved human factors. Computers and Security 1 1 (1982) 54-56
29. Ristad E.S., and Yianilos P.N. Learning string-edit distance. IEEE Transactions on Pattern Analysis and Machine Intelligence 20 5 (1998) 522-532
30. Segars A.H., and Grover V. Re-examining perceived ease of use and usefulness: a confirmatory factor analysis. MIS Quarterly 17 4 (1993) 517-525
31. Shimonski, R., 2002. Hacking techniques. IBM developerWorks, 〈http://www-106.ibm.com/developerworks/library/s-crack/#h1〉.
32. Smith S.L. Authenticating users by word association. Computers and Security 6 (1987) 464-470
33. Stuart G., and Hulme C. The effects of word co-occurrence on short-term memory: associative links in long-term memory affect short-term memory performance. Journal of Experimental Psychology: Learning, Memory, and Cognition 26 3 (2000) 798-802
34. Summers W.C., and Bosworth E. Password policy: the good, the bad, and the ugly. ACM International Conference Proceeding Series; Proceedings of the Winter International Symposium on Information and Communication Technologies 58 (2004) 1-6
35. Wikipedia, 2005. Levenshtein distance, www.wikipedia.org, 〈http://en.wikipedia.org/wiki/Levenshtein_distance〉.
36. Yan J., Blackwell A., Anderson R., and Grant A. Password memorability and security: empirical results. IEEE Security and Privacy 2 5 (2004) 25-31
37. Zviran M., and Haga W.J. Cognitive password: the key to easy access control. Computers and Security 9 8 (1990) 723-736
38. Zviran M., and Haga W.J. A comparison of password techniques for multilevel authentication mechanisms. The Computer Journal 36 3 (1993) 227-237
39. Zviran M., and Haga W.J. Password security: an empirical study. Journal of Management Information Systems 15 4 (1999) 161-185