Password portfolios and the finite-effort user: Sustainably managing large numbers of accounts

Proceedings of the 23rd USENIX Security Symposium

Volumn , Issue , 2014, Pages 575-590

  Florêncio, Dinei ^a   Herley, Cormac ^a   Van Oorschot, Paul C ^b  

^a MICROSOFT RESEARCH   (United States)

^b CARLETON UNIVERSITY   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

FINANCIAL DATA PROCESSING; INVESTMENTS;

LOSS MINIMIZATION; MODEL-BASED OPC; OBJECTIVE FUNCTIONS; OPTIMAL SOLUTIONS; PORTFOLIO MANAGEMENTS; PORTFOLIO STRATEGIES; STRONG PASSWORD; WEAK PASSWORDS;

AUTHENTICATION;

EID: 85076288823     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (49)

1. Stop. Think. Connect. http://www.stopthinkconnect.org/.
2. US-Cyber Emergency Response Readiness Team: CyberSecurity Tips. http://www.us-cert.gov/cas/tips/.
3. A. Adams and M. A. Sasse. Users are not the enemy. CACM, pages 40-46, December 1999.
4. A. Beautement and A. Sasse. The economics of user effort in information security. Computer Fraud & Security, pages 8-12, October 2009.
5. A. Beautement, M. Sasse, and M. Wonham. The Compliance Budget: Managing Security Behaviour in Organisations. In NSPW, 2008.
6. G. S. Becker. Crime and punishment: An economic approach. In Essays in the Economics of Crime and Punishment, pages 1-54. UMI, 1974.
7. J. Bonneau. Guessing human-chosen secrets. University of Cambridge. Ph.D. thesis, May 2012.
8. J. Bonneau. The science of guessing: analyzing an anonymized corpus of 70 million passwords. In Proc. IEEE Symp. on Security and Privacy, pages 538-552, 2012.
9. J. Bonneau and S. Preibusch. The password thicket: Technical and market failures in human authentication on the web. In WEIS, 2010.
10. J. Bonneau and S. Schechter. Towards reliable storage of 56-bit secrets in human memory. In Proc. USENIX Security, 2014.
11. A. Brown, E. Bracken, S. Zoccoli, and K. Douglas. Generating and remembering passwords. Applied Cognitive Psychology, 18(6):641-651, 2004.
12. W. Burr, D. F. Dodson, and W. Polk. Electronic Authentication Guideline. In NIST Special Pub 800-63, 2006.
13. W. Cheswick. Rethinking passwords. USENIX LISA, 2010. http://www.usenix.org/event/lisa10/tech/slides/cheswick.pdf.
14. W. Cheswick. Rethinking passwords. ACM Queue, 10(12):50-56, 2012.
15. W. Cheswick, S. Bellovin, and A. Rubin. Firewalls and Internet Security, 2/e. Addison-Wesley, 2003.
16. S. Chiasson, A. Forget, E. Stobert, P. C. van Oorschot, and R. Biddle. Multiple password interference in text passwords and click-based graphical passwords. In Proc. ACM CCS, 2009.
17. A. Das, J. Bonneau, M. Caesar, N. Borisov, and X. Wang. The tangled web of password reuse. NDSS, 2014.
18. R. Dhamija and A. Perrig. Deja vu: a user study using images for authentication. In USENIX Security, 2000.
19. S. Egelman, A. Sotirakopoulos, I. Muslukhov, K. Beznosov, and C. Herley. Does my password go up to eleven? the impact of password meters on password selection. In Proc. CHI, 2013.
20. D. Florêncio and C. Herley. Where Do All the Attacks Go? Proc. WEIS, 2011, Fairfax, VA.
21. D. Florêncio and C. Herley. A Large-Scale Study of Web Password Habits. Proc. WWW, 2007.
22. D. Florêncio and C. Herley. Where Do Security Policies Come From? Proc. SOUPS, 2010.
23. D. Florêncio, C. Herley, and P. van Oorschot. An Administrator's Guide to Internet Password Research. In Proc. USENIX LISA, 2014.
24. S. Gaw and E. Felten. Password Management Strategies for Online Accounts. In ACM SOUPS, 2006.
25. M. Gouda, A. Liu, L. Leung, and M. Alam. Single password, multiple accounts. In ACNS (Industry Track), 2005.
26. B. Grawemeyer and H. Johnson. Using and managing multiple passwords: A week to a view. Interacting with Computers, 23(3):256-267, 2011.
27. E. Grosse and M. Upadhyay. Authentication at scale. IEEE Security & Privacy, 11(1):15-22, 2013.
28. E. Hayashi and J. Hong. A diary study of password usage in daily life. In CHI (note), pages 2627-2630, 2011.
29. C. Herley. So Long, And No Thanks for the Externalities: Rational Rejection of Security Advice by Users. Proc. NSPW, 2009.
30. Imperva. Consumer Password Worst Practices. 2010. http://www.imperva.com/docs/WP_Consumer_Password_Worst_Practices.pdf.
31. P. Inglesant and M. A. Sasse. The true cost of unusable password policies: Password use in the wild. In CHI, 2010.
32. B. Ives, K. Walsh, and H. Schneider. The Domino Effect of Password Reuse. C. ACM, 47(4):75-78, 2004.
33. M. Jakobsson and S. Myers. Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft. Wiley, 2006.
34. D. Kahneman. Thinking, fast and slow. Macmillan, 2011.
35. D. Kahneman and A. Tversky. Prospect theory: An analysis of decision under risk. Econometrica: Journal of the Econometric Society, pages 263-291, 1979.
36. A. Karp. Forum (comment). C. ACM, 47(6):11-12, 2004.
37. P. G. Kelley, S. Komanduri, M. L. Mazurek, R. Shay, T. Vidas, L. Bauer, N. Christin, L. F. Cranor, and J. Lopez. Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. In Proc. IEEE Symp. on Security and Privacy, 2012.
38. R. Lemos. Yahoo breach highlights password reuse threat. eWeek. July 7, 2012.
39. J. Ma, W. Yang, M. Luo, and N. Li. A study of probabilistic password models. Proc. IEEE Symp. on Security and Privacy, 2014.
40. H. Markowitz. Portfolio selection. The Journal of Finance, 7(1):77-91, 1952.
41. R. Nithyanand and R. Johnson. The password allocation problem. In WPES, 2013. Nov. 4, 6 pages.
42. G. Notoatmodjo. Exploring the 'weakest link': A study of personal password security. C.S. Dept., University of Auckland, 2007. M. Sc. thesis.
43. S. Preibusch and J. Bonneau. The password game: negative externalities from weak password practices. In Decision and Game Theory for Security, pages 192-207. Springer Berlin Heidelberg, 2010.
44. S. Riley. Password security: what users know and what they actually do. Usability News, 8(1), 2006.
45. M. Sasse, S. Brostoff, and D. Weirich. Transforming the "weakest link": a human-computer interaction approach to usable and effective security. BT Tech. J., 19(3):122-131, 2001.
46. A. Shamir. 2002 Turing Award Lecture. http://amturing.acm.org/vp/shamir_2327856.cfm.
47. E. Stobert and R. Biddle. The password life cycle: user behaviour in managing passwords. In Proc. SOUPS, 2014.
48. M. Weir, S. Aggarwal, M. Collins, and H. Stern. Testing metrics for password creation policies by attacking large sets of revealed passwords. In Proc. ACM CCS, 2010.
49. Y. Zhang, F. Monrose, and M. K. Reiter. The security of modern password expiration: An algorithmic framework and empirical analysis. In Proc. ACM CCS, 2010.