Password Reuse Research Articles

Rational security: Modelling everyday password use

To inform the design of security policy, task models of password behaviour were constructed for different user groups—Computer Scientists, Administrative Staff and Students. These models identified internal and external constraints on user behaviour and the goals for password use within each group. Data were drawn from interviews and diaries of password use. Analyses indicated password security positively correlated with the sensitivity of the task, differences in frequency of password use were related to password security and patterns of password reuse were related to knowledge of security. Modelling revealed Computer Scientists viewed information security as part of their tasks and passwords provided a way of completing their work. By contrast, Admin and Student groups viewed passwords as a cost incurred when accessing the primary task. Differences between the models were related to differences in password security and used to suggest six recommendations for security officers to consider when setting password policy.

Dynamic identity‐based single password anti‐phishing protocol

AbstractIn the password‐based authentication, password reuse rate increases because the users tend to use the same password with more and more accounts. An average user finds it difficult to remember several complex passwords and hence it is difficult to prevent phishing and dictionary attacks. In 2007, Gouda et al. proposed a single password protocol for HTTP authentication that allows the user to choose a single password of his choice for multiple online accounts on different web servers. It provides to the user the flexibility of changing his password for all accounts on different web servers. However, we found that Gouda et al.'s protocol is not secure against offline dictionary attack, denial of service attack and man‐in‐the‐middle attack in the presence of an active attacker. An improvement to Gouda et al.'s protocol is proposed that resists offline dictionary attack and denial of service attack but cannot resists man‐in‐the‐middle attack. Moreover, it is found that Gouda et al.'s protocol is not repairable for man‐in‐the‐middle attack. In this paper, we present a new single password‐based anti‐phishing protocol that resolves aforementioned problems and is secure against different possible attacks. In this protocol, the client machine's browser generates a dynamic identity and a dynamic password for each login request to the server. The dynamic identity and dynamic password will be different for the same client in different sessions of the Secure Socket Layer (SSL) protocol. The client's password verifier information for different online accounts is stored on the server protected with a hash function, nonce value and the private key of the server. The proposed protocol makes financial transactions more secure on the web as it is practical and efficient. Copyright © 2009 John Wiley & Sons, Ltd.

Multiple hashes of single key with passcode for multiple accounts

A human’s e-life needs multiple offline and online accounts. It is a balance between usability and security to set keys or passwords for these multiple accounts. Password reuse has to be avoided due to the domino effect of malicious administrators and crackers. However, human memorability constrains the number of keys. Single sign-on server, key hashing, key strengthening and petname system are used in the prior arts to use only one key for multiple online accounts. The unique site keys are derived from the common master secret and specific domain name. These methods cannot be applied to offline accounts such as file encryption. We invent a new method and system applicable to offline and online accounts. It does not depend on HTTP server and domain name, but numeric 4-digit passcode, key hashing, key strengthening and hash truncation. Domain name is only needed to resist spoofing and phishing attacks of online accounts.

The Good and Not So Good of Enforcing Password Composition Rules

ABSTRACT Many systems rely on password composition rules to force users to choose more secure passwords. The findings discussed here are from a study on the enforcement of good password practice in the form of password composition rules. The results show that the enforcement of password composition rules does not discourage users from using meaningful information in passwords. While composition rules reduce password reuse, the overall incidence remains high. Passwords created under these conditions are also perceived to be more difficult to remember. Nevertheless, the enforcement of password composition rules does significantly improve protection against dictionary-based attack.

Authenticating Mobile Device UsersThrough Image Selection

Adequate user authentication is a persistent problem, particularly with mobile devices such as Personal Digital Assistants (PDAs), which tend to be highly personal and at the fringes of an organization's influence. Yet these devices are being used increasingly in military and government agencies, hospitals, and other business settings, where they pose a risk to security and privacy, not only from sensitive information they may contain, but also from the means they typically offer to access such information over wireless networks. User authentication is the first line of defence for a mobile device that falls into the hands of an unauthorized individual. However, motivating users to enable simple PIN or password mechanisms and periodically update their authentication information is difficult at best. This paper describes a general-purpose mechanism for authenticating users through image selection. The underlying rationale is that image recall is an easy and natural way for users to authenticate, removing a serious barrier to users' compliance with corporate policy. The approach described distinguishes itself from other attempts in this area in several ways, including style dependent image selection, password reuse, and embedded salting, which collectively overcome a number of problems in employing knowledge-based authentication on mobile devices.