Password Research Articles

OPTIMIZING CREDIT CARD SECURITY USING CONSUMER BEHAVIOR DATA: A BIG DATA AND MACHINE LEARNING APPROACH TO FRAUD DETECTION

Credit card fraud is still very much a problem in the United States, which has experienced increased opportunity in online shopping and digital payments. This paper aims at examining how the consumer data such as the demographic data, the purchasing behavior and the security measures they adopt can help improve fraud prevention measures. This study is based on survey data of 200 participants from US credit card users, supported by data on recent frauds. Other variables considered were age, income, number of online transactions, password creation and protection and two-factor authentication. Quantitative data approaches such as descriptive and inferential statistics were used in this study whereby chi-square tests, t-tests and logistic regression were used in an attempt to determine the significant relationships that exist between consumer characteristics and fraud risk. A cross-tabulation of the variables provided a measure of association and showed that increased age, income level and the number of transactions made online were associated with increased vulnerability to fraud. Users with a low age and high income were classified as high-risk users because they make frequent transactions online and have larger amounts of digital data. Participants who provided proactive activities in security practice like changing passwords often and the use of two-factor authentication had a low risk of fraud, the need for consumers to be aware of risks. Results indicate that it is possible to improve the security of credit cards in the US financial sector by implementing individual anti-fraud measures considering the behavioral and demographic characteristics of consumers. Consumer behavioral data enables the institutions to adopt dynamic approaches that involve real-time transaction notification and behavior-driven analytics to enhance the accuracy of fraud identification and reduce on false alarms. This paper also shows that behavior-inspired, evidence-based approaches hold the key to the improvement of credit card security and consumer confidence. Subsequent studies shall analyze how compliance influences the advanced data-based security solutions and such research can use the aged fraud typologies and trends to understand their possible changes over time.

“Protect Me Tomorrow”: Commitment Nudges to Remedy Compromised Passwords

Internet users often neglect important security actions (e.g., installing security updates or changing passwords) because they interrupt users’ main task at inopportune times. Commitment devices, such as reminders and promises, have been found to be effective at reducing procrastination in other domains. In a series of online experiments ( \(n{\gt}3{,}000\) ), we explored the effects of reminders and promises on users’ willingness to change a compromised password. We find that adding an option to delay the task increases the share of people willing to eventually change their password considerably. Critically, the option to delay yields this overall increase without reducing the share of people choosing to change their password immediately. Additionally, most participants who promised to change their password later, or asked to be reminded to do so, indeed followed through on their commitment, leading to a net positive effect. Reminding participants of their previous commitment further increased this effect.

Encouraging Users to Change Breached Passwords Using the Protection Motivation Theory

We draw on the Protection Motivation Theory (PMT) to design interventions that encourage users to change breached passwords. Our online experiment ( \(n=1{,}386\) ) compared the effectiveness of a threat appeal (highlighting the negative consequences after passwords were breached) and a coping appeal (providing instructions on changing the breached password) in a 2 \(\times\) 2 factorial design. Compared to the control condition, participants receiving the threat appeal were more likely to intend to change their passwords, and participants receiving both appeals were more likely to end up changing their passwords. Participants’ password change behaviors are further associated with other factors, such as their security attitudes (SA-6) and time passed since the breach, suggesting that PMT-based interventions are useful but insufficient to fully motivate users to change their passwords. Our study contributes to PMT’s application in security research and provides concrete design implications for improving compromised credential notifications.

Design and Implementation of USB Key System Based on Dual-Factor Identity Authentication Protocol

With the increasing demand for information security, traditional single-factor authentication technology can no longer meet security requirements. To this end, this paper proposes a Universal Serial Bus (USB) Key hardware and software system based on a two-factor authentication protocol, aiming to improve the security and reliability of authentication. This paper first analyzes the current status and technical principles of USB Key-related research domestically and internationally and designs a two-factor authentication protocol that combines impact/response authentication and static password authentication. The system consists of a host computer and a USB Key device. The host computer interacts with the USB Key through a graphical user interface. The Secure Hash Algorithm 1 (SHA-1) and MySQL database are used to implement the authentication function. Experimental results show that the designed two-factor authentication protocol can effectively prevent replay attacks and information tampering, and improve the security of authentication. If the corresponding USB Key is not inserted, the system will prompt that the device is not found. Once the USB Key is inserted, user identity is confirmed through two-factor verification, which includes impact/response authentication and static password authentication.

Reducing the risk of social engineering attacks using SOAR measures in a real world environment: A case study

The global cost of successful cyberattacks is increasing annually, with there being a shift towards social engineering threats in recent years. Cybercriminals are increasingly targeting humans rather than technical systems, recognizing data as a critical resource, especially in the finance industry where breaches can lead to substantial losses and reputational damage. The present case study proposes measures to reduce human susceptibility to social engineering attacks, leveraging SOAR (Security Automation, Orchestration, and Response) technology for incident response automation. The study covers various issues in cybersecurity, SOAR, and social engineering, through analyzing interviews with expert practitioners in the field, addressing cybersecurity skills shortages and current cyber threats. Four social engineering vignettes were developed, representing real threats, along with specific SOAR measures implemented using Microsoft Sentinel. These measures were simulated to demonstrate their effectiveness by reducing the employee's vulnerability to social engineering attacks. The risk of social engineering attacks was successfully reduced by implementing a responsive approach through the developed SOAR measures. Some of the measures reduced the risk by locking user accounts or forcing password changes after a detected cyber incident while another measure was developed for awareness enhancements. Given the current shortage of cybersecurity professionals, technologies like SOAR are becoming increasingly relevant for security teams. However, SOAR alone cannot address all challenges posed by social engineering and should be viewed as a complementary measure rather than a standalone solution.

Locally unidentifiable subset of quantum states and its resourcefulness in secret password distribution

Locally unidentifiable subset of quantum states and its resourcefulness in secret password distribution

A STRONG AND PRACTICAL AUTHENTICATION MECHANISM USING PASSTEXT AND ONE MINUTE PASSCODE

In this modern world, hacking is growing faster, and there is no privacy for personal data. Therefore, we have decided to create passwords using new methods. This project demonstrates that there is no secret shared between the user and strangers; it presents a one minute challenge to unlock private data. Our project generates random codes minute by minute, and each password is only valid for just one minute, which is called OMP (One Minute Passcode). Therefore, the user doesn't know the correct password at all times. These passkeys are then sent to the user's mobile phone using the Twilio method, which is more secure and provided by Google to communicate through secret authentication methods and tokens. Thus, hacking becomes impossible with this level of complexity. In the future, if there's a possibility of hacking, we will update the cipher methods to unlock the data. Nowadays, the usage of PCs and mobile phones has increased rapidly. What if the passwords are not known by the user or strangers in this modern technology. Our project ensures privacy between users and hackers or strangers; secret passwords may sometimes be compromised, but random passwords will never be known to users or strangers. This idea is used here to maintain safety while unlocking our privacy or private sectors by creating random codes and sending them to the user's mobile IP value or number. We can easily unlock our device in a non-hackable form using brute force and Twilio, which are the main components of our data protection system. In the older authentication method, there were only 6-digit numbersto unlock data, which were available only for apps. Like an OTP, this method randomly generates a 6-digit code to unlock the private sector, which is available on the same phone or PC. This makes it easy for hackers to access details using your phone number or email. These passkeys are dynamic and not stable at all times, and theirsize istoo small. A relational database plays a major role here, we also use the emergency password method for user convenience. KEYWORDS: Security Authentication, Twilio, Database, Spyware attacks, Hacking, Password Authentication,Database.

Healthcare professionals' perception on emergence of security threat using digital health technologies in healthcare delivery.

The advancement of digital health technologies (DHTs) in the healthcare industry has revolutionized healthcare by improving efficiency and accessibility. The shift from paper-based records to electronic health records (EHRs) as a result of modern technologies introduced various security threats, endangering patient data privacy and system reliability. This study explores intricate security threats among healthcare professionals affecting DHT utilization. A structured questionnaire was designed to solicit for data from healthcare professionals on the existence of possible security threats, magnitude of physical and technical threats, and the extent to which the activities of staff and vendors affect the current DHTs being utilized in Cape Coast Teaching Hospital and Directorate of University Health Services at the University of Cape Coast. Purposive and convenience sampling techniques were employed to select healthcare professionals from various medical fields, and their views were captured for the study. Findings and data analyzed from the study revealed that technical threats, such as hacking, phishing, malware, and encryption weaknesses, pose more substantial dangers to DHTs compared to physical threats. The study explored viable strategies to prevent unauthorized access to DHTs and safeguard patient information. Encouraging measures, such as encryption, multi-factor authentication, regular security training, and periodic password changes, emerged as promising methods in addressing DHT security threats. The study emphasizes the necessity of robust security measures and regular updates to effectively counter the emerging security threats. It underscores the critical necessity for a comprehensive protocol to enhance DHT security, addressing physical, technical, and personnel-related threats.

Gathering Dust—Resistance to Simulator-based Deliberate Practice in Microsurgical Training

Abstract Background Despite unrestricted access to a simulated microsurgery model, learners have not consistently self-regulated their learning by completing practice. This paper explores the lived experience of learners regarding how practice is perceived and why it is resisted. Methods A qualitative study was conducted, including recorded and transcribed focus groups and semistructured interviews. First and second pass coding was conducted by one reviewer, with feedback from another. Transcripts were analyzed with a constant comparative approach customary to thematic analysis. Theory was engaged to help explain and support the findings.The study was undertaken at the University of Calgary plastic surgery residency training program in Calgary, Alberta, Canada, involving 15 informants (9 residents and 6 surgeons). Results Four themes emerged: (1) barriers to practice, (2) motivation to practice, (3) owning learning/solutioning, and (4) expectations of practice. Competing priorities and time constraints were barriers. Motivation to practice ranged from extrinsic (gaining access to the next course) to intrinsic (providing optimal patient care). Learners described a range of ownership of learning and depth of effort at solutioning of practice opportunities. Learners expressed high expectations around model fidelity, ease of setup, and feedback. Learners self-regulating their learning, with surgeons acculturating practice at work, can overcome some barriers. As per self-determination theory (SDT), learners need explicit linkage to how the task aligns with their goals. Assessment may be required to motivate learners. In respect of adult learning theory, homework needs to be allocated by a respected trainer. Modeling simulation practice may encourage adult learners. Finally, the tenets of deliberate practice (DP) need to be explained in order that learners can optimize their practice time. Conclusion Microsurgical simulation practice is valued but barriers exist that invite resolution. Assisting residents to overcome barriers, maintain motivation, take ownership, and assimilate DP will help improve their microsurgery practice.

Pattern unlocking guided multi‐modal continuous authentication for smartphone with multi‐branch context‐aware representation learning and auto encoder

AbstractWidely accepted explicit authentication protocols are vulnerable to a series of attacks, for example, shoulder surfing and smudge attacks, leaving users with the constant burden of periodic password changes. As such, we propose a novel framework for continuous authentication on smartphones. This approach is guided by pattern unlocking, which is widely used and will not cause learning cost. After collecting multi‐modal data that describe both behavioral and contextual information, we employ a multi‐branch context‐aware attention network as the representation learner to perform feature extraction, then an auto encoder is then used for authentication. To overcome challenges, including cold‐start and few‐shot training, which is less discussed in other works, we incorporate transfer learning with a coarse‐to‐fine pre‐training workflow. Additionally, we deploy a hierarchical approach to offload model tuning overhead from smartphones. Extensive experiments on more than 68 000 real‐world recordings validate the effectiveness of the proposed method, with an EER (equal error rate) of 2.472% under mixed contexts, which consistently outperforms state‐of‐the‐art approaches under both static and mixed contexts.

Historical research on classification of Classical Cryptography

Cryptography is now being applied frequently in peoples daily lives. Their bank passcode, computer password, and digital signature all are applications of cryptography. Inside cryptography, Classical Cipher is a basic and important area as modern cryptography is developed from Classical Cryptography. By making a consummate system of Classical Cryptography, it increases peoples interest in exploring basic cryptography principles. This essay focuses mainly on the topic of classification of Classical Cipher. By reading related materials like books, journals, magazines and so on, the historical research came out the conclusion as the Classical Cipher can be classified as Substitution Cipher, Polyalphabetic Substitution Cipher, and Transposition Cipher. In each class, the essay mentioned several cipher examples, how they encrypt and decrypt the text, and how they can be broken. Caesar Cipher, Simple Substitution Cipher are examples of Substitution Cipher. Vigenere Cipher is mainly discussed inside the Polyalphabetic Substitution Cipher section. In Transposition Cipher part, Scytale and Rail Fence Cipher are listed to demonstrate traits of the Transposition Cipher.

Affective Response to Feelings of Password Fatigue by Password Change Requirements

Affective Response to Feelings of Password Fatigue by Password Change Requirements

Role of authentication factors in Fin-tech mobile transaction security

Fin-Tech is the merging of finance and technology, to be considered a key term for technology-based financial operations and money transactions as far as Fin-Tech is concerned. In the massive field of business, mobile money transaction security is a great challenge for researchers. The user authentication schemes restrict the ability to enforce the authentication before the account can access and operate. Although authentication factors provide greater security than a simple static password, financial transactions have potential drawbacks because cybercrime expands the opportunities for fraudsters. The most common enterprise challenge is mobile-based user authentication during transactions, which addresses the security issues against fraudsters. The confirmation of a user legitimation before the money transaction is highlighted by mechanisms and technologies from previous studies that may be helpful in user authentication. This study aims to identify the technologies for user authentication and the opportunity for their transformation to mobile money transaction security despite having all the legally required data for a transaction. This proposed review has identified the role of multifactor authentication techniques for authentication to mitigate the risk of fraudulent transactions—the analysis through 92 articles taken from famous publishers. The most relevant articles address authentication problems, of which 54 percent describe money transaction security, and the rest highlight the supporting technology for user authentication. The study platform described the technology-based approaches with the appreciation of new ideas for secure money transactions. The QR code and multifactor authentication are key terms that increased security by 46%. In addition, this also ensures the user is legitimate using advanced technologies and algorithms to predict and discover transaction risks and discourage fraudsters from trying.

A Three-Factor-Based Authentication Scheme of 5G Wireless Sensor Networks for IoT System

Internet of Things (IoT) is an expanding technology that facilitate physical devices to inter-connect each other over a public channel. Moreover, the security of the next-generation wireless mobile communication technology, namely 5G with IoT, has been a field of much interest among researchers in the last several years. Previously, Sharif et al. had suggested an IoTbased lightweight three-party authentication scheme proclaiming a secured scheme against different threats. However, it was found that the scheme could not achieve user anonymity and guarantee session key security. Additionally, the scheme fails to provide proper authentication in the login phase, and it s unable to update a new password in the password change phase. Thus, we propose an improved three-factor-based data transmission authentication scheme (TDTAS) to address the weaknesses. The formal security analysis has been proved using the Real-or-Random (RoR) model. The informal security analysis demonstrates that the scheme is secure against several known attacks and achieves more security features. In addition, the comparison of the work with other related schemes demonstrates the proposed scheme has less communicational and storage costs.

HIPAA Compliance for Telehealth to Be Required Again on August 9

Back to table of contents Next article Government & LegalFull AccessHIPAA Compliance for Telehealth to Be Required Again on August 9Mark MoranMark MoranSearch for more papers by this authorPublished Online:31 May 2023AbstractHIPAA compliance is about more than just technology—it also means having physical or environmental and process security measures in place. A business associate agreement with a vendor may be necessary to ensure compliance with HIPAA.The federal Office of Civil Rights (OCR) in April extended the deadline for requiring telehealth compliance with the Health Insurance Portability and Accountability Act (HIPAA) by 90 days to August 9.At that time, health care professionals practicing telehealth must comply with HIPAA’s Security Rule and will no longer be able to use standard video technologies such as Zoom, Skype, or Facebook to meet with patients, as they had been allowed to do during the Public Health Emergency (PHE), which ended on May 11. Even before the new deadline, psychiatrists and other health care professionals need to pay attention to state rules about HIPAA compliance as well as the requirements of their institution, organization, or practice.“Best practices to ensure environmental privacy include clinicians connecting from a private space and letting patients know if there are others in the room with them,” said Shabana Khan, M.D. “This demonstrates to patients that their telehealth clinician values protecting their health information.”“OCR is providing this transition period to allow health care practitioners and practices to make necessary changes to ensure that their telehealth technologies are private and secure in a way that is adherent with HIPAA rules,” said Shabana Khan, M.D., chair of the APA Committee on Telepsychiatry. “Though OCR has provided this 90-day transition period through August 9, telehealth clinicians must also consider state rules and practice or organization requirements when deciding which technologies to use for telehealth services. We have this flexibility at the federal level, but an organization may require that their clinicians use approved HIPAA-adherent technologies.”HIPAA, which was signed in 1996 by President Bill Clinton, sets national standards for health information protections. The U.S. Department of Health and Human Services (HHS) established these standards to ensure protected health information (PHI) processed and utilized by “covered entities” is private and secure. OCR is responsible for implementing and enforcing this rule. HIPAA requirements cover a broad range of patient data and information, including making an appointment, conducting the appointment, and billing the patient’s insurance.HIPAA encompasses two major rules: the Privacy Rule and the Security Rule. The Privacy Rule protects all identifiable data of an individual patient; the Security Rule, a subset of the Privacy Rule, protects information that a covered entity creates, receives, maintains, or transmits in electronic form.So what does it mean to be HIPAA compliant when providing telehealth services? Importantly, it’s not just about technology. It also means having physical or environmental and process security measures in place to ensure that only those who are supposed to have access to patients’ information are able to get it.“Environmental privacy best practices include clinicians connecting from a private space and letting patients know if there are others in the room with them—for instance, a nurse or medical student who may be off screen,” Khan said. “Clinicians should also provide guidance to their patients on the importance of connecting to telehealth visits from a private space and avoiding public or semi-public settings. Clinicians can also ask patients if there is anyone in the room with them at the start of the visit. This demonstrates to patients that their telehealth clinician values protecting their health information.”Technology features that can help a HIPAA-covered entity meet compliance requirements include the following:Fully encrypted data transmission.Additional authentication and security through required passwords.Secure point-to-point connection.Private high-speed network.Administrative, physical, and technical safeguards for electronic protected health information.Audit controls.Breach notification.John Torous, M.D., chair of the APA Committee on Mental Health IT, said psychiatrists must use vendors of telehealth technology who can assure HIPAA compliance and have a signed business associate agreement (BAA).“Often you can use the same product (such as Zoom) without a BAA, but to make it HIPAA complaint, a psychiatrist needs to use the version of Zoom that requires the signature of a BAA,” he wrote in an email. “Regardless of the technology, being HIPAA complaint means the psychiatrist still has to offer reasonable physical safeguards (such as keeping computer passwords secure) and have process safeguards in place too (restricting access to patient files, creating plans for appropriate use of data).” ■ResourcesHHS Office for Civil Rights AnnouncementHIPAA & HIT: A PrimerSummary of the HIPAA Privacy RuleThe Security Rule ISSUES NewArchived

Balancing Password Security and User Convenience: Exploring the Potential of Prompt Models for Password Generation

With the increasing prevalence of cyber attacks and data breaches, the importance of strong passwords cannot be overstated. Password generating software has been widely used to generate complex passwords that are difficult to crack, but it has its limitations. One of the main problems with this kind of software is that it often generates passwords that are difficult to remember, leading to users write them down or reuse them across multiple accounts. In recent years, prompt models such as ChatGPT have emerged as a promising solution for generating strong and memorable passwords. By leveraging machine learning algorithms, these models can generate unique and complex passwords tailored to individual users’ preferences, making them easier to remember and more secure. However, the use of prompt models to generate passwords also raises concerns about exposing vulnerable passwords. Hackers can potentially use these models to predict passwords by analyzing a user’s online activity and personal data. Additionally, the constant need to change passwords to stay secure poses a challenge for both password generating software and prompt models. As technology continues to evolve, finding a balance between password security and user convenience remains a complex issue. While prompt models such as ChatGPT can offer a promising solution, it is essential to consider the potential risks and challenges associated with their use, including the constant need for password changes and the potential vulnerability of the generated passwords.

A robust ECC-based authentication framework for energy internet (EI)-based vehicle to grid communication system

The integration of electric vehicles (EVs) into the smart grid system through Vehicle-to-Grid (V2G) technology enables bi-directional power delivery, allowing EVs to distribute excess electricity to the grid and recharge as needed. However, V2G networks face significant security and privacy challenges due to the involvement of large amounts of data and untrusted entities. To address these challenges, we propose a new authentication protocol based on Elliptic Curve Cryptography (ECC) that enables secure communication between EVs and charging stations in V2G networks. The proposed plan functions by going through four primary phases, which are: 1) Initialization, 2) Registration, 3) Authentication and 4) password change, vehicle revoke and new joining. Our protocol aims to maintain secure connections while minimizing computation and communication costs through the use of lightweight cryptographic operations such as one-way hash functions, concatenation, and bitwise Xor operations. We validated the security of our protocol through both informal and formal security analyses, including verification with the Scyther Verification tool, which confirms that the proposed protocol is free from security threats within bounds. Our ECC-based authentication protocol for V2G is more secure and lightweight compared to other related protocols in the same context. Our contributions are: 1) A new ECC-based authentication framework for energy Internet (EI)-based V2G communication systems, and 2) The use of lightweight cryptographic operations to reduce computational expenditure and improve resource utilization. Overall, our proposed protocol provides a robust and secure framework for V2G communication that can address the significant security and privacy challenges facing V2G networks.

Evaluation of Follow-Up Monitoring Information System Using Hot Fit Model

This study evaluates the effectiveness of the Follow-Up Monitoring Information System (SIPTL) of the Supreme Audit Agency of the Republic of Indonesia (BPK RI) based on the HOT Fit Model. Evaluation is focused on external SIPTL or from the auditee side. This research is qualitative research with a case study approach, and the object of the research is the Inspectorate of Majene Regency, West Sulawesi. Evaluation is carried out on human aspects (system use and user satisfaction), organization (organizational structure), and technology (system, information, and service quality). In the human aspect of human resources (HR) management, it shows the suitability of the field of experience, knowledge, and competence. In the organizational aspect, controlling access rights is very good in the form of passwords for each admin and SIPTL inputer. In terms of technology, the speed of access between pages and the addition of features in the SIPTL application is very high. Thus, in general, the external SIPTL application at the Majene Regency Inspectorate has been effective based on the HOT Fit Model. The disadvantages of SIPTL at this time are the absence of regular training for users, communication with users that has not been running optimally, the absence of regular password changes, and the absence of regular application updates. Further research is recommended to evaluate the internal SIPTL, namely from the perspective of BPK RI as a user and the addition of research objects as a comparative analysis.

Secure authentication framework based on one-time password for internet of things

Like other systems, the IoT field needs to be secured and efficient. IoT network knows as a complex network because of the number of devices it contains. An important part of the security is the authentication that allows different devices to identify each other and authenticate themselves. Authentication can be achieved using different methods from the simplest static pass-words to the encrypted dynamic password. Unlike other systems, IoT devices have less processing power capability and a short memory; therefore, authentication schemes should be suitable. The authentication field is the potential target for many attackers because it is designed to protect systems. Hence, attackers developed many ways to get into systems. On the other side, security researchers and specialists evolved accordingly to cope with attacks. Authentication begins with static passwords, then a one-time password, and a multi-factor. How-ever, a secure authentication framework based on a one-time password (OTP) is going to be proposed in this paper.

The Effect of Cyber Security Risks on E-Governance usage: A Case Study of Tanzanian Immigration Department

The use of e-Governance, has offered citizens a convenient, efficient and transparent manner of enjoying most important services. However, ICT services are prone to cyber security threats which can hinder the effective and efficient usage of e-Governance services. This study assessed the effect of cyber security threats and risks on the Tanzania e-Governance services usage at the Immigration department. The study has used an exploration research design to collect primary data from 113 randomly sampled respondents at the Tanzania Immigration department. The data was analysed descriptively to determine the frequency and mean relationships between the variables. Additionally, a regression model has been used to determine the direction of relationships between the independent and dependent variables. The findings revealed that 93.8% of the respondents are aware of the e-Governance services. However, this is not proportional to the e-Governance usage since only 27.4% of the responding officers indicated that they are frequent users of the service. The study further indicate that the system faces minimal security risks at the department which is a result of well-established security defense system such as the use of strong and frequent password change. The study recommends e-governance service operators should constantly monitor the systems to identify threats, develop a more user-friendly architecture, and promote adoption among Tanzanians.