Password Creation Research Articles

The Effect of Domain Terms on Password Security

The predominant authentication method still relies on usernames and passwords. To enhance memorability, domain terms may have been opted to include as part of passwords. However, there is little analysis of the extent to which such practice affects password security, so there is a lack of guidance on how users use domain terms on websites with different domain characteristics. To address the problem, we propose a novel approach to analyze the security effect of using domain terms in passwords. The methodology primarily consists of three stages. Firstly, we utilize Web crawlers to harvest domain vocabularies, subsequently leveraging the TextRank algorithm to rank their importance. Afterward, we propose an algorithm for constructing a simulated domain-specific password dataset by replacing password elements with domain terms. Finally, password guessing experiments are done on the dataset using PCFG and Markov model to evaluate the impact of domain terms on password security. The experimental results indicate that, for systems without clear domain, 20% domain terms replacement in the test set can reduce the cracking rate by up to 5.45%. In contrast, for domain-specific systems, 20% domain terms replacement in the training set can increase the cracking rate by 6.45%. These findings provide practical guidance on the application of domain knowledge in password creation for different types of systems. In summary, this study offers a novel perspective for exploring the security implications of passwords influenced by specific domains.

Secret sharing in online communities: A comparative analysis of offender and non-offender password creation strategies

Secret sharing in online communities: A comparative analysis of offender and non-offender password creation strategies

Priming through Persuasion: Towards Secure Password Behavior

Users tend to create weak passwords even for the important accounts. The prior research shed light on user's insecure password behavior, and why the interventions, including requirement specification (e.g., password composition policies) and feedback systems (e.g., password meters) fail in practice. To this end, we propose and evaluate the concept: priming-through-persuasion in the realm of secure password creation. In particular, we created visual designs, aimed at priming users about the repercussions of weak passwords before their password creation. We base our designs on two forms of persuasion methods: pathos and logos. Pathos appeals to people's emotion in order to persuade them towards an expected behavior, where logos-based rhetoric appeals to a person's sense of reason. We conducted a lab study including participatory design and semi-structured interview with 20 participants. We updated our designs in an iterative manner based on the feedback from our participants in the lab study. To evaluate our updated designs, we conducted a between-subject online study with 131 participants over Amazon Mechanical Turk. Our study provides insight into how the use of persuasion techniques contributed to user attachment and engagement with the design, as well as the comprehension of the conveyed message about password vulnerabilities. Our findings lead to the guideline for future research on leveraging the priming-through-persuasion to complement the existing techniques in encouraging users towards secure behavior.

Ethical hacking: real evaluation model of brute force attacks in password cracking

Despite ongoing efforts to convince users of the value of password security and to enforce password creation standards on them, in many information systems the human factor still plays a role. In addition, not only do most users’ password creation and management practices largely remain unchanged, but password cracking tools and more critically, computer hardware also continue to advance. In this paper we present a model in ethical hacking; the proposed model concentrated on brute force attacks for password cracking. The main novelty of our work is that it first presents a mathematical model that calculates the number of different password permutations of varying lengths. Then the brute force attack is modelled using the Markov chain model and a method is developed to formulate the conventional optimization problem, which is classified as a discrete nonlinear problem. The experiments’ results demonstrate and validate the method’s effectiveness and suitability.

Rethinking Smart Keyboard Layout to Aid Strong Password Creation

In an era marked by increasing digitization and the omnipresence of smartphones, the importance of robustpassword security cannot be overstated. With the ever-growing threat of cyberattacks, there is a pressing needfor user-friendly tools that facilitate the creation of strong and unique passwords. Traditional alphanumerickeyboard layouts (physical or virtual) have remained largely unchanged for decades, relying on the sameQWERTY layout initially designed for typewriters. However, these layouts may not be optimal for generatingstrong passwords. This paper focuses on tailoring virtual keyboard layouts on smartphones specifically forstrong password creation. For this, we have performed extensive user surveys to see if the presence ofdedicated rows for digits and special characters (essential in any strong password) allows users to createstronger passwords compared to regular smartphone keyboard layout. Apart from that, we also investigatedthe optimal assignment of characters, digits, and special characters and their groupings in a single soft key.The findings from the detailed user experiment suggested optimal settings for a smartphone virtual keyboard(for Android) like- diagonal length for good typing speed (approximately between 8.38 and 9.41 cm), andkey density (0.88 to 1.21 keys/cm2) which produces the least error without sacrificing the strength ofpasswords created using those layouts. We hope the outcome of this paper will help designers to aid virtualkeyboard layouts for smartphones that can motivate and create strong passwords without sacrificing usability.

Enhancing User Authentication with Facial Recognition and Feature-Based Credentials

This research proposes a novel and trustworthy user authentication method that creates individualized and trusted credentials based on distinctive facial traits using facial recognition technology. The ability to easily validate user identification across various login methods is provided by this feature. The fundamental elements of this system are face recognition, feature extraction, and the hashing of characteristics to produce usernames and passwords. This method makes use of the OpenCV library, which is free software for computer vision. Additionally, it employs Hashlib for secure hashing and Image-based Deep Learning for Identification (IDLI) technology to extract facial tags. For increased security and dependability, the system mandates a maximum of ten characters for users and passwords. By imposing this restriction, the system increases its resilience by reducing any possible weaknesses in its defense. The policy also generates certificates that are neatly arranged in an Excel file for easy access and management. To improve user data and provide reliable biometric authentication, this study intends to create and implement a recognition system that incorporates cutting-edge approaches such as face feature extraction, feature hashing, and password creation. Additionally, the system has robust security features using face recognition.

Password cracking using chunk similarity

Textual password is one of the most important authentic means used in modern information systems and password cracking is an important means of measuring password strength. Recently, data-driven approaches are proposed in order to improve the efficiency and accuracy of the password guessing process. These methods usually train a model based on leaked password datasets so as to capture the internal patterns hidden behind the human created passwords, and most of them focus on the relationships between characters within a password. In this article, we emphasizes that the character relations between passwords need also to be considered. We treat a password as a sequence of chunks or segments, which is a small sub-string of the password and appears frequently in a password dataset. Instead of modeling the relations of chunks within a password, we proposed a method, which selects a seed password from a training set, breaks the seed password into chunks, and then generates new passwords by choosing a chunk and replacing it with another one according to their similarities. Several experiments are conducted on three password datasets so as to evaluate different aspects of the proposed approach. The results show that the proposed method is comparable with the state-of-the-art approaches, such as PassGAN, DPG, FLA and PCFG v4.3, which is the latest version of PCFG. The results also revealed that chunk level relations between passwords play an important role in the process of password creation.

An Empirical Study of Password Policy Compliance

Cybersecurity exploits that take advantage of weak passwords continue to succeed in virtually every industry. This motivates interest in empirically determining the extent to which websites that invite visitors to create new user accounts on them encourage or require users to engage in better password management practices, including strong passwords. This project examined a statistically significant sample of websites to assess how closely they voluntarily adhere to the National Institute of Standards and Technology’s authoritative guidance on password policies. Over 100 representative websites were selected from industries that consistently report the most breaches in the Verizon Data Breach Investigation Report. Their respective user account creation processes were assessed via a scorecard approach based on observations collected when following standardized experimental procedures. Scorecard data then were aggregated and analyzed for trends. The research findings highlight potential vulnerabilities that persist in online account password creation practices, leaving many websites susceptible to brute force attacks due to cyber hygiene lapses. Recommendations to help remediate compliance gaps and as paths forward to build upon this work include refining the proposed scorecard, creating and using standardized user registration and profile manager plugins, widely adopting user-friendly password management tools, and enacting tougher legal consequences for website hosts when breaches occur.

Do Security Fear Appeals Work When They Interrupt Tasks? A Multi-Method Examination of Password Strength

Weak passwords are one of the most pervasive threats in cybersecurity. Facing this threat, users require guidance on how to protect themselves. A method frequently used by IS practitioners and researchers to provide this guidance is fear appeals, persuasive messages intended to prompt behavioral changes in response to a threat. However, previous research has not considered a key element of fear appeal effectiveness: task primacy. When fear appeals are a part of the primary or focal task, users’ cognitive engagement will be high by default. However, when fear appeals are delivered as secondary tasks, such as interruptive security messages, users’ engagement is likely to be low because the primary task takes priority in attentional and cognitive resources. In such cases, a remedy is needed to elicit engagement with the fear appeal. In this research note, we theorize that cognitive engagement acts as a contextual moderator that is critical to the effectiveness of fear appeals under the boundary condition of task primacy. Further, we theorize that interactivity, a mechanism that adapts message content through tailored real-time feedback in response to a user’s actions, is a key remedy to enhance engagement with fear appeals. However, to date fear appeals have largely been tested in noninteractive primary tasks, and no study has provided a theoretical explanation for why interactivity enhances the power of a fear appeal. We empirically examined engagement as a contextual moderator in two ways. First, we conducted a field experiment, which manipulated messages on a password creation form on a real-world website. Second, we performed a qualitative focus group study to triangulate the experimental results and more fully reify our theoretical model. Together, the findings reveal that interactivity acts as a catalyst to engage participants with a fear appeal, which then allows the persuasive message of the fear appeal to be internalized. The concepts of boundary condition of task primacy and engagement suggest ways that fear appeals can be more effectively applied in research and practice.

Hybrid password meters for more secure passwords – a comprehensive study of password meters including nudges and password information

ABSTRACT Supporting users with secure password creation is a well-explored yet unresolved research topic. A promising intervention is the password meter, i.e. providing feedback on the user's password strength as and when it is created. However, findings related to the password meter's effectiveness are varied. An extensive literature review revealed that, besides password feedback, effective password meters often include: (a) feedback nudges to encourage stronger passwords choices and (b) additional guidance. A between-subjects study was carried out with 645 participants to test nine variations of password meters with different types of feedback nudges exploiting various heuristics and norms. This study explored differences in resulting passwords: (1) actual strength, (2) memorability, and (3) user perceptions. The study revealed that password feedback, in combination with a feedback nudge and additional guidance, labelled a hybrid password meter, was generally more efficacious than either intervention on its own, on all three metrics. Yet, the type of feedback nudge targeting either the person, the password creation task, or the social context, did not seem to matter much. The meters were nearly equally efficacious. Future work should explore the long-term effects of hybrid password meters in real-life settings to confirm the external validity of these findings.

User-Centric Adaptive Password Policies to Combat Password Fatigue

Today, online users will have an average of 25 password-protected accounts online, yet use, on average, 6.5 passwords. The excessive cognitive burden of remembering large amounts of passwords causes Password Fatigue. Therefore users tend to reuse passwords or recycle password patterns whenever prompted to change their passwords regularly. Researchers have created Adaptive Password Policies to prevent users from creating new passwords similar to previously created ones. However, this approach creates user frustration as it neglects users’ cognitive burden. This paper proposes a novel User-Centric Adaptive Password Policy (UCAPP) Framework for password creation and management that assigns users system-generated passwords based on a cognitive-behavioural agent-based model. The framework comprises a Password Policy Assignment Test (PassPAST), a Cognitive Burden Scale (CBS), a User Profiling Algorithm, and a Password Generator (PassGEN). The framework creates tailor-made password policies that maintain password memorability for users of different cognitive thresholds without sacrificing password strength and entropy. The framework successfully created 30-40% stronger passwords for Critical users and random (non-mnemonic) passwords for Typical users based on each individual’s cognitive password thresholds in a preliminary test.

Comparison of BlindLoginV2 and AudioBlindLogin with the common textual password authentication for the blind and visually impaired using smartphones

BlindLoginV2 and AudioBlindLogin were designed as memorable and usable graphical authentication systems for the blind and visually impaired, to reduce their difficulties in authentication as compared to alphanumeric or biometric authentication. The main aim of this paper is to compare the use of these two alternative graphical authentication systems with the traditional textual-based authentication, and to encourage the blind and visually impaired to use smartphone authentication, by overcoming the difficulties of maneuvering the virtual keyboard. It compares BlindLoginV2 and AudioBlindLogin with the 4-character common traditional textual authentication system, in terms of password creation time, mean login time performance and failure rate, and identifies the factors influencing the mean login time performance of BlindLoginV2 (object picture superiority effect) and AudioBlindLogin (auditory picture superiority effect) for the blind and visually impaired. Quantitative testing results show that both proposed systems are more accessible for the visually impaired as compared with the traditional text-based authentication system because the password creation time and mean login time is significantly shorter with lower failure rates. Results also show that the type of authentication method, the visual capability and the age of the user, and the interactions between these three factors significantly influences the mean login time performance.

A study on priming methods for graphical passwords

Recent work suggests that a type of nudge or priming technique called the presentation effect may potentially improve the security of PassPoints-style graphical passwords. These nudges attempt to prime or non-intrusively bias user password choices (i.e., point selections) by gradually revealing a background image from a particular edge to another edge at password creation time. We conduct a large-scale user study (n=710) to develop further insights into the presence of this effect and to perform the first evaluations of its security impacts. We explore the usability impacts of this effect using the subset (n=100) of participants who returned for all three sessions. Our usability analyses indicate that these priming techniques do not harm usability. Our security analyses reveal that the priming techniques can measurably enhance the security of graphical passwords; however, this effect is dependent on the combination of both the image and priming techniques used.

Prioritizing security over usability: Strategies for how people choose passwords

AbstractPasswords are one of the most common security technologies that people use everyday. Choosing a new password is a security decision that can have important consequences for end users. Passwords can be long and complex, which prioritizes the security-focused aspects of a password. They can also be simple—easy to create, remember, and use—which prioritizes the usability aspects of the password. The tradeoff between password security versus usability represents competing constraints that shape password creation and use. We examined an ecologically valid dataset of 853 passwords entered a total of 2533 times by 134 users into 1010 websites, to test hypotheses about the impact of these constraints. We found evidence that choices about password complexity reflect an emphasis on security needs, but little support for the hypothesis that users take day-to-day ease of use of the password into account when creating it. There was also little evidence that password creation policies drive password choices.

Nudging users towards better security decisions in password creation using whitebox-based multidimensional visualisations

ABSTRACT Nudging users to keep them secure online has become a growing research field in cybersecurity. While existing approaches are mainly blackbox based, showing aggregated visualisations as one-size-fits-all nudges, personalisation turned out promising to enhance the efficacy of nudges within the high variance of users and contexts. This article presents a disaggregated whitebox-based visualisation of critical information as a novel nudge. By segmenting users according to their decision-making and information processing styles, we investigate if the novel nudge is more effective for specific users than a common black-box nudge. Based on existing literature about critical factors in password security, we designed a dynamic radar chart and parallel coordinates as disaggregated visualisations. We evaluated the short-term effectiveness and users' perception of the nudges in a think-aloud prestudy and a representative online evaluation (N=1.012). Our findings suggest that dynamic radar charts present a moderately effective nudge towards stronger passwords regarding short-term efficacy and are appreciated particularly by players of role-playing games.

Захист інформації відомчої інформаційно-телекомунікаційної мережі за допомогою парольної системи

The approach to quantitative estimation of stability of password systems taking into account power of space of passwords and length of the password is theoretically substantiated. The formalized idea of information entropy as an approach to measuring the amount of information that is unknown through random variables is determined by the randomness of a variable based on the knowledge contained in another part of the message. It is established that the greater the entropy in a given distribution of passwords, the more difficult it is to guess the password that was chosen from this distribution; passwords with higher entropy values require more expected assumptions, which makes entropy useful as a measure of password strength. Proposals for password management of the departmental information and telecommunication network of the object of critical information infrastructure are given. Studies show that much of the entropy introduced by uppercase and lowercase characters is created by users who exceed the minimum requirements of the password strength policy. Secure password creation is complicated by the trade-off between developing passwords that are both difficult to crack and use. Accordingly, the access control policy is important. Studies show that much of the entropy introduced by large and non-alphanumeric characters is created by users who exceed the minimum requirements of the password strength policy: the use of more digits than necessary, different positions of special characters. It is concluded that text passwords remain the dominant method of authentication in computer systems, despite significant improvements, including smart cards, RFID cards, USB tokens and graphic passwords, which have their advantages and are suitable for use in a particular environment or for a specific program. It is noted that there are few published empirical studies that would examine the strategies used by users under different password policies. Further research is planned in this direction/

Group-based Password Characteristics Analysis

In this article, we analyze password characteristics from the perspective of user groups in different countries and web-based services. We collect a dataset from the Chinese railway website www.12306.cn. which contains data from four provinces, Hubei, Zhejiang, Inner Mongolia and Xinjiang. Additionally, we select datasets from two English based Internet applications, Faithwrit-er and Facebook. We analyze these six datasets based on several common indicators, including popular passwords, password structure and letter distribution. The analysis results show that there are remarkable differences in different user groups. The experiments show that geographical factors (embodied in the native language) and types of website services play a significant role in password creation. We further evaluate the security of these passwords by employing two state-of-the-art password cracking techniques. The attack results show that datasets of different provinces and different types of website services have different password strength. To the best of our knowledge, this is the first time passwords are analyzed based on different user groups.

Surviving in the Digital Environment: Does Survival Processing Provide an Additional Memory Benefit to Password Generation Strategies?

People encouraged to think about their survival when encoding information experience a memory advantage even when compared to other tried-and-true methods. Despite the evidence in support of the survival-processing advantage, how this advantage might apply to current-day issues has received little attention. This study aimed to determine if password generation strategies modified to encourage fitness-related encoding would yield an additional benefit in password recall. Participants recruited from online and college samples generated passwords using a sentence-based mnemonic (pilot experiment and Experiment 1) or person-action-object strategy (Experiments 2 and 3), in survival or control scenarios. Results support the plausibility of implementing different strategies for password generation, particularly the person-action-object strategy, and the importance of providing users instructions with which to create their passwords. Although the results illustrated the value of using scenarios for password creation, they did not show evidence of an additional fitness-related benefit, for possible reasons that we discuss.

Comparative Analysis of Three Language Spheres: Are Linguistic and Cultural Differences Reflected in Password Selection Habits?

This work aims to determine the propensity of password creation through the lens of language spheres. To this end, we consider three different countries/languages, each with a different culture: China/Chinese, United Kingdom (UK)/English, and Japan/Japanese. We first employ a user study to verify whether language and culture are reflected in password creation. We found that users in all three countries prefer to create their passwords from base words, and the kinds of words they are incorporated into passwords vary between countries. We then test whether the findings obtained through the user study are reflected in a corpus of leaked passwords. We found that users in China and Japan prefer dates, while users in Japan and the UK prefer names. We also found that cultural words(e.g., sakura in Japan and football in the UK) are frequently used to create passwords. Finally, we demonstrate that the knowledge on the linguistic background of targeted users can be exploited to increase the speed of the password guessing process.

Constructing secure and memorable passwords

PurposeUsing authentication to secure data and accounts has grown to be a natural part of computing. Even if several authentication methods are in existence, using passwords remain the most common type of authentication. As long and complex passwords are encouraged by research studies and practitioners alike, computer users design passwords using strategies that enable them to remember their passwords. This paper aims to find strategies that allow for the generation of passwords that are both memorable and computationally secure.Design/methodology/approachThe study began with a literature review that was used to identify cognitive password creation strategies that facilitate the creation of passwords that are easy to remember. Using an action-based approach, attack models were created for the resulting creation strategies. The attack models were then used to calculate the entropy for passwords created with different strategies and related to a theoretical cracking time.FindingsThe result of this study suggests that using phrases with four or more words as passwords will generate passwords that are easy to remember and hard to attack.Originality/valueThis paper considers passwords from a socio-technical approach and provides insight into how passwords that are easy to remember and hard to crack can be generated. The results can be directly used to create password guidelines and training material that enables users to create usable and secure passwords.