Effectiveness of image-based mnemonic techniques for enhancing the memorability and security of user-generated passwords

Computers in Human Behavior

Volumn 26, Issue 4, 2010, Pages 705-715

  Nelson, Deborah ^a   Vu, Kim Phuong L ^b  

^a Sage North America   (United States)

^b CALIFORNIA STATE UNIVERSITY   (United States)

Author keywords

Human memory; Mnemonics; Passwords; Security; Username password

Indexed keywords

HUMAN MEMORY; IMAGE-BASED; PASSWORD SECURITY;

EID: 77955231421     PISSN: 07475632     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.chb.2010.01.007     Document Type: Article

References (44)

1. Armstrong, I. (2003). Passwords exposed: Users are the weakest link. SC magazine. Available from: http://www.scmagazine.com/asia/news/article/419622/ passwords-exposed-users-weakest-link/ Retrieved April 22, 2008.
2. D.P. Ausubel The use of advance organizers in the learning and retention of meaningful verbal material Journal of Educational Psychology 51 1960 267 272
3. A.D. Baddeley Your memory: A user's guide 2004 Firefly Books New York
4. F.S. Bellezza Mnemonic devices: Classification, characteristics, and criteria Review of Educational Research 51 1981 247 275
5. M. Bishop, and D.V. Klein Improving system security via proactive password checking Computers & Security 14 1995 233 249
6. Blonder, G. E. (1996). Graphical passwords. United States Patent 5559961.
7. Brostoff, S., & Sasse, M. A. (2001). Safe and sound: A safety-critical approach to security. In Proceedings of the 2001 workshop on new security paradigms (pp. 41-50), September 10-13, 2001. Cloudcroft, New Mexico.
8. F.I.M. Craik, and R.S. Lockhart Levels of processing: A framework for memory research Journal of Verbal Learning and Verbal Behavior 11 1972 671 684
9. F.I.M. Craik, and E. Tulving Depth of processing and the retention of words in episodic memory Journal of Experimental Psychology: General 104 1975 268 294
10. A. De Angeli, L. Coventry, G. Johnson, and K. Renaud Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems International Journal of Human-Computer Studies 63 2005 128 152
11. P.A. deWinstanley, and E.L. Bjork Processing strategies and the generation effect: Implications for making a better reader Memory and Cognition 32 2004 945 955
12. Dhamija, R., & Perrig, A. (2000). Déj vu: A user study using images for authentication. In Proceedings of the ninth USENIX security symposium (p. 4), 2000. Denver, Colorado.
13. Florêncio, D., & Herley, C. (2007). A large scale study of web password habits. WWW 2007, May 8-12, 2007. Banff, BC.
14. A. Greenwald, and M.R. Banaji The self as a memory system: Powerful, but ordinary Journal of Personality and Social Psychology 57 1989 41 54
15. Grimes, R. A. (2006). MySpace password exploit: Crunching the numbers (and letters). Available from: http://www.InfoWorld.com/article/06/11/17/ 47OPsecadvise-1.html Retrieved November 30, 2007.
16. L.D. Groninger, and L.K. Groninger Autobiographical episodes as mediators in the recall of words The American Journal of Psychology 101 1988 515 538
17. Internet Crime Complaint Center (2009). 2008 Internet Crime Report. Available from: http://www.ic3.gov/media/annualreport/2008-IC3Report.pdf Retrieved January 14, 2010.
18. B. Ives, K.R. Walsh, and H. Schneider The domino effect of password reuse Communications of the ACM 47 4 2004 75 78
19. Klein, D. V. (1990). Foiling the cracker: A survey of, and improvements to, password security. In Proceedings of the second usenix workshop on security (pp. 5-14), August, 1990. Portland, OR, USA.
20. G.A. Miller The magical number seven, plus or minus two: Some limits on our capacity for processing information Psychological Review 63 1956 81 97
21. R. Morris, and K. Thompson Password security: A case history Communications of the ACM 22 1979 594 597
22. A. Paivio Imagery and verbal processes 1971 Holt, Rinehart & Winston New York
23. A. Paivio, T.B. Rogers, and P.C. Smythe Why are pictures easier to recall than words? Psychonomic Science 11 4 1968 137 138
24. R.W. Proctor, M.-C. Lien, K.-P.L. Vu, E.E. Schultz, and G. Salvendy Improving computer security for authentication of users: Influence of proactive password restrictions Journal of Behavior Research Methods, Instruments, and Computers 34 2002 163 169
25. B.L. Riddle, M.S. Miron, and J.A. Semo Passwords in use in a university timesharing environment Computers and Security 8 1989 569 578
26. H.L. Roediger The effectiveness of four mnemonics in ordering recall Journal of Experimental Psychology: Human Learning and Memory 6 1980 558 567
27. T.B. Rogers, N.A. Kuiper, and W.S. Kirker Self-reference and the encoding of personal information Journal of Personality and Social Psychology 35 1977 677 688
28. SafeNet (2005). 2004 annual password survey results. Available from: www.safenet-inc.com. Downloaded on May 21, 2006.
29. B. Schneier Secrets and lies 2000 John Wiley New York
30. E.E. Schultz Web security and privacy R.W. Proctor, K.-P.L. Vu, Handbook of human factors in web design 2005 Erlbaum Mahwah, NJ 613 628
31. R.N. Shepard Recognition memory for words, sentences and pictures Journal of Verbal Learning and Verbal Behavior 6 1967 156 163
32. N.J. Slamecka, and P. Graf The generation effect: Delineation of a phenomenon Journal of Experimental Psychology: Human Learning and Memory 4 1978 592 604
33. J. Snowman, R. McCown, and R. Biehler Psychology applied to teaching 12th ed. 2008 Wadsworth Publishing Belmont, CA
34. L.R. Squire, and S. Zola-Morgan Episodic memory, semantic memory, and amnesia Hippocampus 8 1998 205 211
35. L. Standing, J. Conezio, and R.N. Haber Perception and memory for pictures: Single trial learning of 2500 stimuli Psychonomic Science 19 1970 73 74
36. Stubblefield, A., & Simon, D. R. (2004). Inkblot Authentication (Technical Report MSR-TR-2004-85). Microsoft Corporation, Redmond, WA, USA.
37. Tullis, T. S., & Tedesco, D. P. (2005). Using personal photos as pictorial passwords. CHI 2005, April 2-7, 2005. Portland, OR, USA.
38. E. Tulving Episodic and semantic memory E. Tulving, W. Donaldson, Organization of memory 1972 Academic Press New York 381 403
39. Vu, K.-P. L., Bhargav, A., & Proctor, R. W. (2003). Imposing password restrictions for multiple accounts: Impact on generation and recall of passwords. In Proceedings of the 47th annual meeting of the human factors and ergonomics society (pp. 1331-1335). Santa Monica, CA: HFES.
40. Vu, K.-P. L., Cook, J., Bhargav, A., & Proctor, R. W. (2006, April). Short-term and long-term retention of passwords generated by first-letter and entire-word mnemonic methods. In Proceedings of the fifth annual security conference. Published on CD-ROM.
41. Vu, K.-P. L., Garcia, F., Nelson, D., Sulatis, J., Creekmur, B., & Chambers, V. (2007). Examining user privacy policies while shopping online: What are users looking for? In Proceedings of the 12th international conference on human-computer interaction (pp. 792-801), July 22-27, 2007. Beijing, China.
42. K.-P.L. Vu, R.W. Proctor, A. Bhargav-Spantzel, B.-L. Tai, J. Cook, and E.E. Schultz Improving password security and memorability to protect personal and organizational information International Journal of Human-Computer Studies 65 2007 744 757
43. S. Wiedenbeck, J. Waters, J.-C. Birget, A. Brodskiy, and N. Memon PassPoints: Design and longitudinal evaluation of a graphical password system International Journal of Human-Computer Studies 63 2005 102 127
44. Yan, J., Blackwell, A., Anderson, R., & Grant, A. (2005). Password memorability and security: Empirical results. IEEE Security & Privacy, 2(5), 25-31.