skip to main content
10.5555/2671225.2671264guideproceedingsArticle/Chapter ViewAbstractPublication PagesConference Proceedingsacm-pubtype
Article

Towards reliable storage of 56-bit secrets in human memory

Published: 20 August 2014 Publication History

Abstract

Challenging the conventional wisdom that users cannot remember cryptographically-strong secrets, we test the hypothesis that users can learn randomly-assigned 56- bit codes (encoded as either 6 words or 12 characters) through spaced repetition. We asked remote research participants to perform a distractor task that required logging into a website 90 times, over up to two weeks, with a password of their choosing. After they entered their chosen password correctly we displayed a short code (4 letters or 2 words, 18.8 bits) that we required them to type. For subsequent logins we added an increasing delay prior to displaying the code, which participants could avoid by typing the code from memory. As participants learned, we added two more codes to comprise a 56.4- bit secret. Overall, 94% of participants eventually typed their entire secret from memory, learning it after a median of 36 logins. The learning component of our system added a median delay of just 6.9 s per login and a total of less than 12 minutes over an average of ten days. 88% were able to recall their codes exactly when asked at least three days later, with only 21% reporting having written their secret down. As one participant wrote with surprise, "the words are branded into my brain."

References

[1]
HashCat project. http://hashcat.net/hashcat/.
[2]
"Automated Password Generator (APG)". NIST Federal Information Processing Standards Publication (1993).
[3]
Bitcoin currency statistics. blockchain.info/stats, 2014.
[4]
ADAMS, A., SASSE, M. A., AND LUNT, P. Making passwords secure and usable. In People and Computers XII. Springer London, 1997, pp. 1-19.
[5]
ALLBERY, B. pwgen-random but pronounceable password generator. USENET posting in comp.sources.misc (1988).
[6]
ARNOLD, R. G. The Diceware Passphrase Home Page. world. std.com/~reinhold/diceware.html, 2014.
[7]
ATALLAH, M. J., MCDONOUGH, C. J., RASKIN, V., AND NIRENBURG, S. Natural language processing for information assurance and security: an overview and implementations. In Proceedings of the 2000 New Security Paradigms Workshop (2001), ACM, pp. 51-65.
[8]
ATKINSON, R. C., AND SHIFFRIN, R. M. Human memory: A proposed system and its control processes. The Psychology of Learning and Motivation 2 (1968), 89-195.
[9]
BADDELEY, A. Working memory. Science 255, 5044 (1992), 556-559.
[10]
BADDELEY, A. D. Human memory: Theory and practice. Psychology Press, 1997.
[11]
BALOTA, D. A., DUCHEK, J. M., AND LOGAN, J. M. Is expanded retrieval practice a superior form of spaced retrieval? A critical review of the extant literature. The foundations of remembering: Essays in honor of Henry L. Roediger, III (2007), 83-105.
[12]
BICAKCI, K., AND VAN OORSCHOT, P. C. A multi-word password proposal (gridWord) and exploring questions about science in security research and usable security evaluation. In Proceedings of the 2011 New Security Paradigms Workshop (2011), ACM, pp. 25-36.
[13]
BIDDLE, R., CHIASSON, S., AND VAN OORSCHOT, P. C. Graphical passwords: Learning from the first twelve years. ACM Computing Surveys (CSUR) 44, 4 (2012), 19.
[14]
BLISS, T. V., AND L�MO, T. Long-lasting potentiation of synaptic transmission in the dentate area of the anaesthetized rabbit following stimulation of the perforant path. The Journal of Physiology 232, 2 (1973), 331-356.
[15]
BLOCKI, J. Usable Human Authentication: A Quantitative Treatment. PhD thesis, Carnegie Mellon University, June 2014.
[16]
BLOCKI, J., BLUM, M., AND DATTA, A. Naturally rehearsing passwords. In Advances in Cryptology-ASIACRYPT 2013. Springer, 2013, pp. 361-380.
[17]
BOJINOV, H., SANCHEZ, D., REBER, P., BONEH, D., AND LINCOLN, P. Neuroscience meets cryptography: designing crypto primitives secure against rubber hose attacks. In Proceedings of the 21st USENIX Security Symposium (2012).
[18]
BONNEAU, J. Guessing human-chosen secrets. PhD thesis, University of Cambridge, May 2012.
[19]
BONNEAU, J. Moore's Law won't kill passwords. Light Blue Touchpaper, January 2013.
[20]
BONNEAU, J., HERLEY, C., VAN OORSCHOT, P. C., AND STAJANO, F. The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes. In 2012 IEEE Symposium on Security and Privacy (May 2012).
[21]
BONNEAU, J., JUST, M., AND MATTHEWS, G. What's in a Name? Evaluating Statistical Attacks on Personal Knowledge Questions. In FC '10: Proceedings of the the 14th International Conference on Financial Cryptography (January 2010).
[22]
BONNEAU, J., PREIBUSCH, S., AND ANDERSON, R. A birthday present every eleven wallets? The security of customer-chosen banking PINs. In FC '12: Proceedings of the the 16th International Conference on Financial Cryptography (March 2012).
[23]
BONNEAU, J., AND SCHECHTER, S. Towards reliable storage of 56-bit secrets in human memory (extended version). Tech. rep., Microsoft Research.
[24]
BONNEAU, J., AND SHUTOVA, E. Linguistic properties of multiword passphrases. In USEC '12: Workshop on Usable Security (March 2012).
[25]
BOYEN, X. Halting password puzzles. In USENIX Security Symposium (2007).
[26]
BRAND, S. Department of Defense Password Management Guideline.
[27]
BRANTZ, T., AND FRANZ, A. The Google Web 1T 5-gram corpus. Tech. Rep. LDC2006T13, Linguistic Data Consortium, 2006.
[28]
BROSTOFF, A. Improving password system effectiveness. PhD thesis, University College London, 2004.
[29]
BROWN, D. R. Prompted User Retrieval of Secret Entropy: The Passmaze Protocol. IACR Cryptology ePrint Archive 2005 (2005), 434.
[30]
BUNNELL, J., PODD, J., HENDERSON, R., NAPIER, R., AND KENNEDY-MOFFAT, J. Cognitive, associative and conventional passwords: Recall and guessing rates. Computers & Security 16, 7 (1997), 629-641.
[31]
BUNTING, M. Proactive interference and item similarity in working memory. Journal of Experimental Psychology: Learning, Memory, and Cognition 32, 2 (2006), 183.
[32]
BURR, W. E., DODSON, D. F., AND POLK, W. T. Electronic Authentication Guideline. NIST Special Publication 800- 63 (2006).
[33]
CAMERON, K. A., HAARMANN, H. J., GRAFMAN, J., AND RUCHKIN, D. S. Long-term memory is the representational basis for semantic verbal short-term memory. Psychophysiology 42, 6 (2005), 643-653.
[34]
CAPLE, C. The Effects of Spaced Practice and Spaced Review on Recall and Retention Using Computer Assisted Instruction. PhD thesis, North Carolina State University, 1996.
[35]
CEPEDA, N. J., PASHLER, H., VUL, E., WIXTED, J. T., AND ROHRER, D. Distributed practice in verbal recall tasks: A review and quantitative synthesis. Psychological Bulletin 132, 3 (2006), 354.
[36]
CHIASSON, S., FORGET, A., BIDDLE, R., AND VAN OORSCHOT, P. C. Influencing users towards better passwords: persuasive cued click-points. In Proceedings of the 22nd British HCI Group Annual Conference on People and Computers: Culture, Creativity, Interaction-Volume 1 (2008), British Computer Society, pp. 121-130.
[37]
CHIASSON, S., VAN OORSCHOT, P. C., AND BIDDLE, R. Graphical password authentication using cued click points. In Computer Security-ESORICS 2007. Springer, 2007, pp. 359- 374.
[38]
CLAIR, L. S., JOHANSEN, L., ENCK, W., PIRRETTI, M., TRAYNOR, P., MCDANIEL, P., AND JAEGER, T. Password exhaustion: Predicting the end of password usefulness. In Information Systems Security. Springer, 2006, pp. 37-55.
[39]
DAVIS, D., MONROSE, F., AND REITER, M. K. On User Choice in Graphical Password Schemes. In USENIX Security Symposium (2004), vol. 13, pp. 11-11.
[40]
DHAMIJA, R., AND PERRIG, A. D�j� Vu: A User Study Using Images for Authentication. In Proceedings of the 9th Conference on USENIX Security Symposium - Volume 9 (Berkeley, CA, USA, 2000), SSYM'00, USENIX Association, pp. 4-4.
[41]
DI CRESCENZO, G., LIPTON, R., AND WALFISH, S. Perfectly secure password protocols in the bounded retrieval model. In Theory of Cryptography. Springer, 2006, pp. 225-244.
[42]
DUGGAN, G. B., JOHNSON, H., AND GRAWEMEYER, B. Rational security: Modelling everyday password use. International Journal of Human-Computer Studies 70, 6 (2012), 415-431.
[43]
EBBINGHAUS, H. �ber das ged�chtnis: untersuchungen zur experimentellen psychologie. Duncker & Humblot, 1885.
[44]
FAHL, S., HARBACH, M., ACAR, Y., AND SMITH, M. On the ecological validity of a password study. In Proceedings of the Ninth Symposium on Usable Privacy and Security (2013), ACM, p. 13.
[45]
GANESAN, R., DAVIES, C., AND ATLANTIC, B. A new attack on random pronounceable password generators. In Proceedings of the 17th {NIST}-{NCSC} National Computer Security Conference (1994).
[46]
GASSER, M. A random word generator for pronounceable passwords. Tech. rep., DTIC Document, 1975.
[47]
GREENE, R. L. Spacing effects in memory: Evidence for a two-process account. Journal of Experimental Psychology: Learning, Memory, and Cognition 15, 3 (1989), 371.
[48]
JAKOBSSON, M., YANG, L., AND WETZEL, S. Quantifying the security of preference-based authentication. In Proceedings of the 4th ACM Workshop on Digital Identity Management (2008), ACM, pp. 61-70.
[49]
JERMYN, I., MAYER, A., MONROSE, F., REITER, M. K., RUBIN, A. D., ET AL. The design and analysis of graphical passwords. In Proceedings of the 8th USENIX Security Symposium (1999), vol. 8, Washington DC, pp. 1-1.
[50]
JEYARAMAN, S., AND TOPKARA, U. Have the cake and eat it too--Infusing usability into text-password based authentication systems. In Computer Security Applications Conference, 21st Annual (2005), IEEE.
[51]
JOSEFSSON, S. The Base16, Base32, and Base64 Data Encodings. RFC 4648 (Proposed Standard), Oct. 2006.
[52]
JUELS, A., AND RIVEST, R. L. Honeywords: Making Password-cracking Detectable. In Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (New York, NY, USA, 2013), CCS '13, ACM, pp. 145-160.
[53]
KARPICKE, J. D., AND ROEDIGER III, H. L. Expanding retrieval practice promotes short-term retention, but equally spaced retrieval enhances long-term retention. Journal of Experimental Psychology: Learning, Memory, and Cognition 33, 4 (2007), 704.
[54]
KAUFMAN, C., PERLMAN, R., AND SPECINER, M. Network security: Private communication in a public world. Prentice Hall Press, 2002.
[55]
KEITH, M., SHAO, B., AND STEINBART, P. J. The usability of passphrases for authentication: An empirical field study. International Journal of Human-Computer Studies 65, 1 (2007), 17-28.
[56]
KELLEY, P. G., KOMANDURI, S., MAZUREK, M. L., SHAY, R., VIDAS, T., BAUER, L., CHRISTIN, N., CRANOR, L. F., AND LOPEZ, J. Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. In 2012 IEEE Symposium on Security and Privacy (2012), IEEE, pp. 523-537.
[57]
KELSEY, J., SCHNEIER, B., HALL, C., AND WAGNER, D. Secure applications of low-entropy keys. In Information Security. Springer, 1998, pp. 121-134.
[58]
KING, M. Rebus passwords. In Proceedings of the Seventh Annual Computer Security Applications Conference, 1991 (Dec 1991), pp. 239-243.
[59]
KITTUR, A., CHI, E. H., AND SUH, B. Crowdsourcing User Studies with Mechanical Turk. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (New York, NY, USA, 2008), CHI '08, ACM, pp. 453-456.
[60]
KOMANDURI, S., SHAY, R., KELLEY, P. G., MAZUREK, M. L., BAUER, L., CHRISTIN, N., CRANOR, L. F., AND EGELMAN, S. Of passwords and people: measuring the effect of password-composition policies. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (2011), ACM, pp. 2595-2604.
[61]
KURZBAN, S. A. Easily Remembered Passphrases: A Better Approach. SIGSAC Rev. 3, 2-4 (Sept. 1985), 10-21.
[62]
LANDAUER, T., AND BJORK, R. Optimum rehearsal patterns and name learning. In M. M. Gruneberg, PE Morris, & RN Sykes (Eds.), Practical aspects of memory (pp. 625-632), 1978.
[63]
LASTPASS. LastPass Security Notification. http://blog.lastpass.com/2011/05/lastpass-security-notification.html.
[64]
LEONHARD, M. D., AND VENKATAKRISHNAN, V. A comparative study of three random password generators. In IEEE EIT (2007).
[65]
MEUNIER, P. C. Sing-a-Password: Quality Random Password Generation with Mnemonics. 1998.
[66]
MORRIS, R., AND THOMPSON, K. Password Security: A Case History. Communications of the ACM 22, 11 (1979), 594-597.
[67]
MUNROE, R. Password Strength. https://www.xkcd.com/ 936/, 2012.
[68]
PAVLIK, P. I., AND ANDERSON, J. R. Using a model to compute the optimal schedule of practice. Journal of Experimental Psychology: Applied 14, 2 (2008), 101.
[69]
PERCIVAL, C. Stronger key derivation via sequential memory-hard functions. 2009.
[70]
PIMSLEUR, P. A memory schedule. Modern Language Journal (1967), 73-75.
[71]
PROCTOR, R. W., LIEN, M.-C., VU, K.-P. L., SCHULTZ, E. E., AND SALVENDY, G. Improving computer security for authentication of users: Influence of proactive password restrictions. Behavior Research Methods, Instruments, & Computers 34, 2 (2002), 163-169.
[72]
PROVOS, N., AND MAZIERES, D. A Future-Adaptable Password Scheme. In USENIX Annual Technical Conference, FREENIX Track (1999), pp. 81-91.
[73]
RABKIN, A. Personal knowledge questions for fallback authentication: Security questions in the era of Facebook. In Proceedings of the 4th Symposium on Usable Privacy and Security (2008), ACM, pp. 13-23.
[74]
ROSS, J., IRANI, L., SILBERMAN, M. S., ZALDIVAR, A., AND TOMLINSON, B. Who Are the Crowdworkers?: Shifting Demographics in Mechanical Turk. In CHI '10 Extended Abstracts on Human Factors in Computing Systems (New York, NY, USA, 2010), CHI EA '10, ACM, pp. 2863-2872.
[75]
SANCHEZ, D. J., GOBEL, E. W., AND REBER, P. J. Performing the unexplainable: Implicit task performance reveals individually reliable sequence learning without explicit knowledge. Psychonomic Bulletin & Review 17, 6 (2010), 790-796.
[76]
SCHECHTER, S., BRUSH, A. B., AND EGELMAN, S. It's No Secret. Measuring the Security and Reliability of Authentication via "Secret" Questions. In Security and Privacy, 2009 30th IEEE Symposium on (2009), IEEE, pp. 375-390.
[77]
SHAY, R., KELLEY, P. G., KOMANDURI, S., MAZUREK, M. L., UR, B., VIDAS, T., BAUER, L., CHRISTIN, N., AND CRANOR, L. F. Correct horse battery staple: Exploring the usability of system-assigned passphrases. In Proceedings of the Eighth Symposium on Usable Privacy and Security (2012), ACM, p. 7.
[78]
STOBERT, E. A. Memorability of Assigned Random Graphical Passwords. Master's thesis, Carleton University, 2011.
[79]
STROOP, J. R. Studies of Interference in Serial Verbal Reactions. Journal of Experimental Psychology 18, 6 (Dec. 1935), 643-662.
[80]
STUBBLEFIELD, A., AND SIMON, D. Inkblot authentication. Microsoft Research (2004).
[81]
TAO, H., AND ADAMS, C. Pass-Go: A Proposal to Improve the Usability of Graphical Passwords. IJ Network Security 7, 2 (2008), 273-292.
[82]
THE ETHICAL RESEARCH PROJECT. Post-experiment survey for deception studies. https://www.ethicalresearch.org/.
[83]
VAN OORSCHOT, P. C., AND THORPE, J. On predictive models and user-drawn graphical passwords. ACM Transactions on Information and System Security (TISSEC) 10, 4 (2008), 5.
[84]
VAN OORSCHOT, P. C., AND THORPE, J. Exploiting predictability in click-based graphical passwords. Journal of Computer Security 19, 4 (2011), 669-702.
[85]
VERAS, R., COLLINS, C., AND THORPE, J. On the semantic patterns of passwords and their security impact. In Network and Distributed System Security Symposium (NDSS'14) (2014).
[86]
VU, K.-P. L., PROCTOR, R. W., BHARGAV-SPANTZEL, A., TAI, B.-L. B., COOK, J., AND EUGENE SCHULTZ, E. Improving password security and memorability to protect personal and organizational information. International Journal of Human-Computer Studies 65, 8 (2007), 744-757.
[87]
WEINSHALL, D., AND KIRKPATRICK, S. Passwords You'll Never Forget, but Can't Recall. In CHI '04 Extended Abstracts on Human Factors in Computing Systems (New York, NY, USA, 2004), CHI EA '04, ACM, pp. 1399-1402.
[88]
WIEDENBECK, S., WATERS, J., BIRGET, J.-C., BRODSKIY, A., AND MEMON, N. PassPoints: Design and longitudinal evaluation of a graphical password system. International Journal of Human-Computer Studies 63, 1 (2005), 102-127.
[89]
WIXTED, J. T. The psychology and neuroscience of forgetting. Annual Psychology Review 55 (2004), 235-269.
[90]
WOOD, H. M. The use of passwords for controlled access to computer resources, vol. 500. US Department of Commerce, National Bureau of Standards, 1977.
[91]
WOZNIAK, P. SuperMemo 2004. TESL EJ 10, 4 (2007).
[92]
YAN, J. J., BLACKWELL, A. F., ANDERSON, R. J., AND GRANT, A. Password Memorability and Security: Empirical Results. IEEE Security & privacy 2, 5 (2004), 25-31.
[93]
ZVIRAN, M., AND HAGA, W. User authentication by cognitive passwords: an empirical assessment. In Proceedings of the 5th Jerusalem Conference on Information Technology (Oct 1990), pp. 137-144.
[94]
ZVIRAN, M., AND HAGA, W. J. Passwords Security: An Exploratory Study. Tech. rep., Naval Postgraduate School, 1990.
[95]
ZVIRAN, M., AND HAGA, W. J. Password security: an empirical study. Journal of Management Information Systems 15 (1999), 161-186.

Cited By

View all
  • (2019)A Systematic Analysis of User Evaluations in Security ResearchProceedings of the 14th International Conference on Availability, Reliability and Security10.1145/3339252.3340339(1-7)Online publication date: 26-Aug-2019
  • (2019)Enhanced Tacit SecretsInternational Journal of Information Security10.1007/s10207-018-0408-218:2(239-255)Online publication date: 1-Apr-2019
  • (2018)Reinforcing System-Assigned Passphrases Through Implicit LearningProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security10.1145/3243734.3243764(1533-1548)Online publication date: 15-Oct-2018
  • Show More Cited By

Index Terms

  1. Towards reliable storage of 56-bit secrets in human memory

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image Guide Proceedings
    SEC'14: Proceedings of the 23rd USENIX conference on Security Symposium
    August 2014
    1067 pages
    ISBN:9781931971157
    • Program Chair:
    • Kevin Fu

    Sponsors

    • Akamai: Akamai
    • Google Inc.
    • IBMR: IBM Research
    • NSF
    • Microsoft Reasearch: Microsoft Reasearch
    • USENIX Assoc: USENIX Assoc

    Publisher

    USENIX Association

    United States

    Publication History

    Published: 20 August 2014

    Qualifiers

    • Article

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)0
    • Downloads (Last 6 weeks)0
    Reflects downloads up to 19 Oct 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2019)A Systematic Analysis of User Evaluations in Security ResearchProceedings of the 14th International Conference on Availability, Reliability and Security10.1145/3339252.3340339(1-7)Online publication date: 26-Aug-2019
    • (2019)Enhanced Tacit SecretsInternational Journal of Information Security10.1007/s10207-018-0408-218:2(239-255)Online publication date: 1-Apr-2019
    • (2018)Reinforcing System-Assigned Passphrases Through Implicit LearningProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security10.1145/3243734.3243764(1533-1548)Online publication date: 15-Oct-2018
    • (2017)Diversify to surviveProceedings of the Thirteenth USENIX Conference on Usable Privacy and Security10.5555/3235924.3235926(1-12)Online publication date: 12-Jul-2017
    • (2017)Evaluation of user authentication methods in the gadget-free worldPervasive and Mobile Computing10.1016/j.pmcj.2017.06.01740:C(220-241)Online publication date: 1-Sep-2017
    • (2016)Understanding password choicesProceedings of the Twelfth USENIX Conference on Usable Privacy and Security10.5555/3235895.3235911(175-188)Online publication date: 22-Jun-2016
    • (2016)An Empirical Study of Mnemonic Sentence-based Password Generation StrategiesProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security10.1145/2976749.2978346(1216-1229)Online publication date: 24-Oct-2016
    • (2016)Client-CASHProceedings of the 11th ACM on Asia Conference on Computer and Communications Security10.1145/2897845.2897876(165-176)Online publication date: 30-May-2016
    • (2016)Designing Proof of Human-Work Puzzles for Cryptocurrency and BeyondProceedings, Part II, of the 14th International Conference on Theory of Cryptography - Volume 998610.1007/978-3-662-53644-5_20(517-546)Online publication date: 31-Oct-2016
    • (2015)Learning assigned secrets for unlocking mobile devicesProceedings of the Eleventh USENIX Conference on Usable Privacy and Security10.5555/3235866.3235889(277-295)Online publication date: 22-Jul-2015
    • Show More Cited By

    View Options

    View options

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media