Correct horse battery staple: Exploring the usability of system-assigned passphrases

SOUPS 2012 - Proceedings of the 8th Symposium on Usable Privacy and Security

Volumn , Issue , 2012, Pages

  Shay, Richard ^a   Kelley, Patrick Gage ^a   Komanduri, Saranga ^a   Mazurek, Michelle L ^a   Ur, Blase ^a   Vidas, Timothy ^a   Bauer, Lujo ^a   Christin, Nicolas ^a   Cranor, Lorrie Faith ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Passphrases; Password composition policies; System assigned passwords; Usability

Indexed keywords

NATURAL LANGUAGES; PASSPHRASES; RANDOM CHARACTERS; SYSTEM-ASSIGNED PASSWORDS; USABILITY; USABILITY METRICS;

USABILITY ENGINEERING;

AUTHENTICATION;

EID: 84865029255     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2335356.2335366     Document Type: Conference Paper

References (62)

1. A. Adams, M. A. Sasse, and P. Lunt. Making passwords secure and usable. In Proc. HCI, 1997.
2. E. Adar. Why I hate Mechanical Turk research (and workshops). In Proc. CHI Workshop on Crowdsourcing and Human Computation, 2011.
3. G. V. Bard. Spelling-error tolerant, order-independent pass-phrases via the Damerau-Levenshtein string-edit distance metric. In Proc. ACSW, pages 117-124, 2007.
4. A. J. Berinsky, G. A. Huber, and G. S. Len. Using Mechanical Turk as a subject recruitment tool for experimental research. Political Analysis, 2011.
5. M. Bishop and D. V. Klein. Improving system security via proactive password checking. Computers & Security, 14(3):233-249, 1995.
6. J. Bonneau. The science of guessing: analyzing an anonymized corpus of 70 million passwords. In Proc. IEEE Symposium on Security and Privacy, 2012.
7. J. Bonneau, C. Herley, P. C. van Oorschot, and F. Stajano. The quest to replace passwords: A framework for comparative evaluation of Web authentication schemes. In Proc. IEEE Symposium on Security and Privacy, 2012.
8. J. Bonneau and E. Shutova. Linguistic properties of multi-word passphrases. In Proc. USEC, 2012.
9. M. Buhrmester, T. Kwang, and S. D. Gosling. Amazon's Mechanical Turk: A new source of inexpensive, yet high-quality, data? Persp. Psych. Sci., 6(1):3-5, 2011.
10. W. E. Burr, D. F. Dodson, and W. T. Polk. Electronic authentication guideline. Technical report, NIST, 2006.
11. C. Castelluccia, M. Durmuth, and D. Perito. Adaptive password-strength meters from Markov models. In Proc. NDSS, 2012.
12. D. Craddock. Hey! My friend's account was hacked!http://windowsteamblog. com/windows-live/b/windowslive/archive/2011/07/14/hey-my-friend-s-account-was- hacked.aspx, 2011.
13. H. Crawford and J. Aycock. Kwyjibo: automatic domain name generation. Softw: Pract. Exper., 38(14):1561-1567, 2008.
14. M. Davies. The corpus of contemporary American English: 425 million words, 1990-present. Available online at http://corpus.byu.edu/coca/, 2008.
15. M. Dell'Amico, P. Michiardi, and Y. Roudier. Password strength: An empirical analysis. In Proc. INFOCOM, 2010.
16. J. S. Downs, M. B. Holbrook, S. Sheng, and L. F. Cranor. Are your participants gaming the system? Screening Mechanical Turk workers. In Proc. ACM CHI, 2010.
17. D. Florêncio and C. Herley. A large-scale study of web password habits. In Proc. WWW, 2007.
18. A. Forget, S. Chiasson, P. C. van Oorschot, and R. Biddle. Improving text passwords through persuasion. In Proc. SOUPS, 2008.
19. M. Gasser. A random word generator for pronouncable passwords. Technical Report ESD-TR-75-97, The MITRE Corporation, 1975.
20. C. Herley and P. Van Oorschot. A research agenda acknowledging the persistence of passwords. IEEE Security and Privacy, 10(1):28-36, 2012.
21. J. J. Horton, D. G. Rand, and R. J. Zeckhauser. The online laboratory: Conducting experiments in a real labor market. Experimental Economics, 2010.
22. InCommon Federation. Identity assurance profiles bronze and silver v1.1, 2011.
23. P. Inglesant and M. A. Sasse. The true cost of unusable password policies: password use in the wild. In Proc. ACM CHI, 2010.
24. P. G. Ipeirotis. Demographics of Mechanical Turk. Technical Report CeDER-10-01, New York University, 2010.
25. M. Jakobsson and R. Akavipat. Rethinking passwords to adapt to constrained keyboards. Proc. IEEE MoST, 2012.
26. S. Jeyaraman and U. Topkara. Have the cake and eat it too-Infusing usability into text-password based authentication systems. In Proc. ACSAC, 2005.
27. M. Keith, B. Shao, and P. Steinbart. A behavioral analysis of passphrase design and effectiveness. Journal of the Association for Information Systems, 10(2):63-89, 2009.
28. M. Keith, B. Shao, and P. J. Steinbart. The usability of passphrases for authentication: An empirical field study. Int. J. Human-Comp. Studies, 65(1):17-28, 2007. (Pubitemid 44780141)
29. P. G. Kelley, S. Komanduri, M. L. Mazurek, R. Shay, T. Vidas, L. Bauer, N. Christin, and L. F. Cranor. The impact of length and mathematical operators on the usability and security of system-assigned one-time PINs, 2012. Under review.
30. P. G. Kelley, S. Komanduri, M. L. Mazurek, R. Shay, T. Vidas, L. Bauer, N. Christin, L. F. Cranor, and J. Lopez. Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. In Proc. IEEE Symp. Security & Privacy, 2012.
31. A. Kittur, E. H. Chi, and B. Suh. Crowdsourcing user studies with Mechanical Turk. In Proc. ACM CHI, 2008.
32. S. Komanduri, R. Shay, P. G. Kelley, M. L. Mazurek, L. Bauer, N. Christin, L. F. Cranor, and S. Egelman. Of passwords and people: measuring the effect of password-composition policies. In Proc. ACM CHI, 2011.
33. C. Kuo, S. Romanosky, and L. F. Cranor. Human selection of mnemonic phrase-based passwords. In Proc. SOUPS, 2006.
34. S. A. Kurzban. Easily remembered passphrases: a better approach. SIGSAC Rev., 3(2-4):10-21, Sept. 1985.
35. K.-W. Lee and H.-T. Ewe. Passphrase with semantic noises and a proof on its higher information rate. In Proc. CISW, 2007.
36. M. Leonhard and V. Venkatakrishnan. A new attack on random pronounceable password generators. In Proc. IEEE EIT, 2007.
37. M. D. Leonhard and V. N. Venkatakrishnan. A comparative study of three random password generators. In Proc. IEEE EIT, 2007.
38. K. Matsuura. Echo back in implementation of passphrase authentication. 2001.
39. A. Mehler and S. Skiena. Improving usability through password-corrective hashing. In Proc. SPIRE, 2006.
40. R. Munroe. xkcd: Password strength. https://www.xkcd.com/936/, 2012.
41. NIST. Federal information processing standards publication 181: Automated password generator (APG). Technical report, 1993.
42. S. N. Porter. A password extension for improved human factors. Computers and Security, 1(1), 1982.
43. R. W. Proctor, M.-C. Lien, K.-P. L. Vu, E. E. Schultz, and G. Salvendy. Improving computer security for authentication of users: Influence of proactive password restrictions. Behavior Res. Methods, Instruments, & Computers, 34(2):163-169, 2002.
44. A. G. Reinhold. Diceware. http://world.std.com/~reinhold/diceware.html, 1995-2011.
45. S. Riley. Password security: What users know and what they actually do. Usability News, 8(1), Feb. 2006.
46. S. Schechter, C. Herley, and M. Mitzenmacher. Popularity is everything: a new approach to protecting passwords from statistical-guessing attacks. In Proc. HotSec, 2010.
47. B. Schneier. Schneier on security blog. http://www.schneier.com/blog/ archives/2005/06/write-down-your.html, 2005.
48. S. Schoen, M. Hofmann, and R. Reynolds. Defending privacy at the U.S. border: A guide for travelers carrying digital devices. Electronic Frontier Foundation, 2011.
49. A. Schumacher. Security @ CU-Making secure passwords, 2011.
50. C. E. Shannon. A mathematical theory of communication. Bell Syst. Tech. J., 27:379-423, 1949.
51. R. Shay, S. Komanduri, P. G. Kelley, P. G. Leon, M. L. Mazurek, L. Bauer, N. Christin, and L. F. Cranor. Encountering stronger password requirements: user attitudes and behaviors. In Proc. SOUPS, 2010.
52. A. Sotirakopoulos, I. Muslukov, K. Beznosov, C. Herley, and S. Egelman. Motivating users to choose better passwords through peer pressure. SOUPS Poster, 2011.
53. Y. Spector and J. Ginzberg. Pass-sentence-a new approach to computer code. Comput. Secur., 13(2):145-160, Apr. 1994.
54. J. M. Stanton, K. R. Stam, P. Mastrangelo, and J. Jolton. Analysis of end user security behaviors. Comp. & Security, 24(2):124-133, 2005. (Pubitemid 40583824)
55. M. Toomim, T. Kriplean, C. Pörtner, and J. Landay. Utility of human-computer interactions: toward a science of preference measurement. In Proc. ACM CHI, 2011.
56. B. Ur, P. G. Kelley, S. Komanduri, J. Lee, M. Maass, M. Mazurek, T. Passaro, R. Shay, T. Vidas, L. Bauer, N. Christin, and L. F. Cranor. How does your password measure up? The effect of strength meters on password creation. In Proc. USENIX Security, 2012. To appear.
57. M. Weir, S. Aggarwal, M. Collins, and H. Stern. Testing metrics for password creation policies by attacking large sets of revealed passwords. In Proc. CCS, 2010.
58. S. Z. Wilson. The protect IU blog-xkcd agrees: Use a passphrase, 2011.
59. J. Yan, A. Blackwell, R. Anderson, and A. Grant. Password memorability and security: Empirical results. IEEE Security and Privacy, 2(5), Sept. 2004.
60. Y. Zhang, F. Monrose, and M. K. Reiter. The security of modern password expiration: An algorithmic framework and empirical analysis. In Proc. CCS, 2010.
61. M. Zviran and W. J. Haga. A comparison of password techniques for multilevel authentication mechanisms. The Computer Journal, 36(3):227-237, 1993.
62. M. Zviran and W. J. Haga. Password security: an empirical study. J. Mgt. Info. Sys., 15(4), 199