Employing User-Created Pictures to Enhance the Recall of System-Generated Mnemonic Phrases and the Security of Passwords

Abstract

User-created passwords are typically higher in usability but lower in security than computer-generated passwords. This study evaluates the usability and security of a password scheme in which users are assigned computer-generated random passwords and corresponding computer-generated mnemonic phrases. Users created images that matched the phrases to cue password recall at the time of login. Different picture creation methods (drawing, online images, and a combination of both) and a control condition (no picture) were used to examine the effects of picture creation method on password memorability. Login success was measured the day of account creation and after approximately one week. To measure security during the second session, participants were also asked to simulate attackers by attempting to derive others’ passwords from viewing their images. Analysis revealed that pictures enhanced password memorability but picture creation method had no effect on password memorability. There were no significant differences in security across the four conditions.