Password Recall Research Articles

How memory anxiety can influence password security behavior

Password reuse and modification are insecure password behaviors that are becoming increasingly prevalent as users are obliged to remember more passwords to access various digital services. Many users adopt these risky behaviors as a memory strategy in the belief that they have too many passwords for their memories to cope with. One important avenue in password research is metamemory, which encompasses the knowledge and understanding of memory capabilities and strategies. Previous research on password metamemory has examined the role that metamemory plays in memory performance (i.e., how well memory performs) and password recall. However, no previous research to date has investigated whether password reuse and modification are adopted as memory strategies due to an increase in knowledge and understanding of metamemory. To address this gap, two survey studies (Study1: N = 50, Study 2: N = 303) were implemented to examine the role that password metamemory plays in reusing and modifying passwords. Our findings suggest that of all metamemory constructs, users’ anxiety regarding their perceived ability to remember passwords can influence them to reuse and modify their passwords. These findings have potentially important implications because with an enhanced understanding of how users’ anxiety towards remembering passwords influences their security behavior, this could identify means of reducing password reuse and modification, thereby increasing password security and ultimately reduce some of the consequences of insecure password behaviors.

The Effectiveness of Applying Different Strategies on Recognition and Recall Textual Password

Using English words as passwords have been a popular topic in the last few years. The following article discusses a study to compare self-selection of the system-generated words for recognition and selfgenerated words for recall for nouns and mixture words. The results revealed no significant difference between recognition and recall of password nouns. The average memorability rate of noun recognition was 75.72%, slightly higher than noun recall 74.23% in long-term memory. Also, there was no significant difference between recognition and recall mixture word passwords. The average memorability rate of mixture word recognition was 95.23%, and recall was 84.14% in long-term memory. The authors concluded that the recognition and recall of mixed word passwords had a higher memorability rate than nouns.

Surviving in the Digital Environment: Does Survival Processing Provide an Additional Memory Benefit to Password Generation Strategies?

People encouraged to think about their survival when encoding information experience a memory advantage even when compared to other tried-and-true methods. Despite the evidence in support of the survival-processing advantage, how this advantage might apply to current-day issues has received little attention. This study aimed to determine if password generation strategies modified to encourage fitness-related encoding would yield an additional benefit in password recall. Participants recruited from online and college samples generated passwords using a sentence-based mnemonic (pilot experiment and Experiment 1) or person-action-object strategy (Experiments 2 and 3), in survival or control scenarios. Results support the plausibility of implementing different strategies for password generation, particularly the person-action-object strategy, and the importance of providing users instructions with which to create their passwords. Although the results illustrated the value of using scenarios for password creation, they did not show evidence of an additional fitness-related benefit, for possible reasons that we discuss.

Password Recall Following Employment of a Story-Based Mnemonic Strategy

The password creation and management process presents a problem for users as secure passwords are not often very memorable, and memorable passwords are rarely secure (Adams & Sasse, 1999). Given that passwords are currently the dominant authentication method and that this situation is unlikely to change in the near future, it is imperative to continue to investigate the most effective password behaviors. Researchers have suggested that encouraging users to create passwords based on stories can be an effective method to improve password recall (Blocki, Komanduri, Cranor, & Datta, 2015). The Person-Action-Object (PAO) strategy has users create a password string based on a person they select from a predetermined list, which is later paired with an action and an object. Users are asked to imagine the person acting upon said object in a certain context. For instance, a user may imagine Darth Vader (person) bribing (action) a roach (object) among lily pads. The PAO method can help users circumvent much of the forgetting that happens soon after encoding a password. It has separately been suggested that processing pieces of information based on their relevance to one’s own fitness and survival can be the most advantageous type of processing for human memory (Nairne & Pandeirada, 2008; Nairne, Thompson, & Pandeirada, 2007). When paired against some of the most successful classic encoding techniques, processing information in regard to one’s survival has been demonstrated to be more effective (Nairne et al., 2007). The benefit provided by encoding items based on the survival-related context in comparison to similarly vivid contexts has come to be known as the survival processing advantage. Though the survival processing advantage has been found consistently across many memory studies, this advantage has not yet been studied in the context of improving memory for passwords. The present study is one of the first attempts aimed at applying what has been posed as a stone-age memory adaptation to modern-day cyber security issues. Participants were recruited from a university introductory psychology subject pool and participated in a two-part study in exchange for course credit. They were given instructions on how to use the PAO method and randomly assigned to one of two password generation conditions (i.e., vacation or survival). Depending on the context, participants were to imagine their selected person acting upon an item to ensure a successful vacation or their survival in a foreign land. The participants entered the passwords they generated into a simulated shopping website. Participants recalled their passwords after 2-min and 7-day delays. The present study found support for the PAO strategy, but did not find any systematic differences between the survival and vacation encoding conditions aimed at investigating a survival advantage beyond using the PAO strategy. In general, recall accuracy rates were very high across conditions. All participants either remembered their passwords without any mistakes or recalled almost the entirety of their passwords with relatively minor mistakes. The plausibility of implementing the PAO strategy in everyday life is further supported by subjective reports obtained on ease of recall and accuracy ratings. The manner in which participants misremembered their passwords was also systematic (e.g., mistaking the tense of the word “cook”), suggesting that additional training may be effective. Beyond the support obtained for the use of PAO strategies, there were no differences found between the control (vacation) and survival conditions. Given the robust nature of the survival processing advantage in the literature, however, it seems unlikely that it would not apply in the cybersecurity domain. Instead, the PAO strategy itself may have been sufficiently effective to produce ceiling effects that did not allow for the detection of any advantage for the survival processing condition.

On password behaviours and attitudes in different populations

We explore the differences in password behaviours and attitudes of samples of university students, IT professionals, and the general population (non-student and non-IT professional). Currently, text-based password authentication is the most commonly deployed user authentication mechanism, despite numerous alternatives. Passwords are thus a popular research topic, where many password studies are done in universities where the majority of participants are students. Many studies also do not differentiate between IT professionals and others. Thus, we aim to gain insights about the effect of focusing on samples from university students and/or IT professionals. We conducted a 100-participant online user study involving three sessions over 8−10 days. The study tasks involved password creation and password recall. We also surveyed participant’s password-related behaviours and preferences for different authentication methods. Our results provide insights about the effect of using a large proportion of university students and/or IT professionals in password studies. Our findings should be of interest to the research community and also provide useful data to authentication system designers regarding user preferences and attitudes.

Too many passwords? How understanding our memory can increase password memorability

Abstract Passwords are the most common authentication mechanism, that are only increasing with time. Previous research suggests that users cannot remember multiple passwords. Therefore, users adopt insecure password practices, such as password reuse in response to their perceived memory limitations. The critical question not currently examined is whether users’ memory capabilities for password recall are actually related to having a poor memory. This issue is imperative: if insecure password practices result from having a poor memory, then future password research and practice should focus on increasing the memorability of passwords. If, on the other hand, the problem is not solely related to memory performance, but to users’ inaccurate perception of their memory, then future research needs to examine why this is the case and how such false perception can be improved. In this paper we examined this conundrum by contextualizing the memory theory of metamemory, to the password security context. We argue, based on our contextualized metamemory theory, that the recall of multiple passwords is not related to users’ memory capabilities, and therefore users are able to actually remember more passwords than they think. Instead, we argue that users’ perceptions of their memories abilities, in terms of password memory capacity; perceived control over their memory; motivation to remember; and their understanding of their memory, explains why users cannot remember their passwords. We tested our contextualized metamemory theory in the password security context through a longitudinal experiment, examining over 3500 passwords. The results suggest that our contextualized metamemory theory, rather than the general metamemory theory explains password recall. This study has important implications for research in password security, and practice.

Someone in Your Contact List: Cued Recall-Based Textual Passwords

Textual passwords remain the most commonly employed user authentication mechanism, and potentially will continue to be so for years to come. Despite the well-known security and usability issues concerning textual passwords, none of the numerous proposed authentication alternatives appear to have achieved a sufficient level of adoption to dominate in the foreseeable future. Password hints, consisting of a user generated text saved at the account setup stage, are employed in several authentication systems to help users to recall forgotten passwords. However, users are often unable to create hints that jog the memory without revealing too much information regarding the passwords themselves. We propose a rethink of password hints by introducing SỲNTHIMA , a novel cued recall-based textual password method that reveals no information regarding the password, requires no modifications to authentication servers, and requires no additional setup or registration steps. SỲNTHIMA makes use of users’ contact lists, so that mapped password hints extracted from a user’s contacts are automatically generated while the user is typing the password. We create formal models for relevant aspects of the password hint mechanism, define its threat model, and analyze the security and usability of SỲNTHIMA . We also present the results of an in-lab user study of SỲNTHIMA on 30 participants to evaluate its effectiveness and usability. The results demonstrate that SỲNTHIMA minimizes the number of incorrect login attempts and improves long-term password recall, with acceptable login times and positive user feedback. We summarize the lessons learned from the user study, with the hope of provoking further insights regarding the design of effective cued recall-based textual password schemes.

OH, THE HUMANITY! THE CONTROL SIDE OF SYSTEM SECURITY

ABSTRACTIn 1951, Fitts observed that humans are better than machines at inductive reasoning while machines excel at deductive reasoning. Meanwhile, system security users' needs unrepresented in design, require high‐load deductive tasks such as unaided recall of passwords. The purpose of system security is to control access; therefore, security should be approached from the perspective of control theory. Intelligent control theory incorporates critical components of security and structures the diagnostic process in the form of a logical induction. A control theoretic perspective that purports to apply to system security must account for induction in the control loop and automation is often proposed for these solutions. But, there are no fully automated systems. Human users are components of a control process. Modern security systems are almost exclusively logical systems, have hybrid intelligence (hybridized from users and software) and exhibit Emergent Behaviors (EB) that cannot be known a priori. Emergence in complex systems is readily apparent in most failures and frequently labeled latent human error. Human‐system integration‐induced EB must be accounted for because as a source of major vulnerability. The only viable strategy is suggested by control theory and incorporates embedded simulation as a critical component. A human‐centered design perspective is required.

Memory and Motor Processes of Password Entry Error

Passwords are tightly interwoven with the digital fabric of our current society. Unfortunately, passwords that provide better security generally tend to be more complex, both in length and composition. Complex passwords are problematic both cognitively and motorically, leading to both memory and motor errors during recall and entry. It is important that we better understand and disentangle the two error sources, as password entry errors can have significant negative consequences, such as being locked out of a critical information system. We present a computational cognitive model of password recall and typing, with memory and motor errors each contributing to password entry error. With this synthesis we can study human-computer interaction issues involving the usability of computer access control systems, specifically the password as an authentication mechanism. Ultimately we hope to make science-based recommendations for password policies that promote the use of passwords that are more usable.

Employing User-Created Pictures to Enhance the Recall of System-Generated Mnemonic Phrases and the Security of Passwords

User-created passwords are typically higher in usability but lower in security than computer-generated passwords. This study evaluates the usability and security of a password scheme in which users are assigned computer-generated random passwords and corresponding computer-generated mnemonic phrases. Users created images that matched the phrases to cue password recall at the time of login. Different picture creation methods (drawing, online images, and a combination of both) and a control condition (no picture) were used to examine the effects of picture creation method on password memorability. Login success was measured the day of account creation and after approximately one week. To measure security during the second session, participants were also asked to simulate attackers by attempting to derive others’ passwords from viewing their images. Analysis revealed that pictures enhanced password memorability but picture creation method had no effect on password memorability. There were no significant differences in security across the four conditions.

Patient Perceptions of Pre-Implementation of Personal Health Records (PHRs): A Qualitative Study of People Living With HIV in New York City

The purpose of this study was to describe patient perceptions of two different electronic personal health records for patients living with HIV/AIDS in New York City. Seven focus groups were conducted with a total of 54 patient participants. Focus group participants anticipated benefits including increased patient responsibility, health awareness, efficiency, security, and provider benefits (e.g., time savings). Concerns and barriers related to password recall, computer access, and computer literacy. Future research efforts are needed to further delineate the personal health records features and functions necessary to meet the complex health care, social service, and self-management needs of low-income populations of patients living with HIV/AIDS, design effective strategies to overcome barriers to personal health records use, and evaluate the impact of personal health records use on patient empowerment, shared decision making, and HIV-related patient outcomes.

Promoting Memorability and Security of Passwords Through Sentence Generation

Much of our personal information flows through the Internet as we receive online services or make online transactions, making it essential to have reliable security systems to protect against information theft, denial of service, and fraud. The most commonly used method for authentication and identification is entering the username-password combination. However, this method is weak because users select passwords that are easy to remember and easy to crack. We evaluated a sentence-generation method designed to improve recall and security. The sentence-generation method produced crack-resistant passwords when the users were instructed to embed a digit and special character into the sentence (and password). However, the requirements of including a digit and special character also resulted in a cost in the memorability of the password. An analysis of errors identified three areas of research that may develop techniques that promote better recall of passwords using this sentence-generation method.

Imposing Password Restrictions for Multiple Accounts: Impact on Generation and Recall of Passwords

The most commonly used method of identification and authentication for many Web sites is username-password combinations. However, this is a notoriously weak security method because users tend to generate passwords that are easy to remember but also easy to crack. The method of proactive password checking has been proposed to improve security at little cost to memorability, because it allows users to generate their passwords but imposes restrictions to make the passwords more resistant to cracking. The present study evaluated the time and accuracy needed to generate unique passwords that satisfy different restrictions for multiple accounts, as well as the time and accuracy at recalling these passwords. Results showed that password restrictions do not necessarily improve the security of the password generated by users by making them more resistant to cracking because cracking software have become increasingly sophisticated. Although users show good recall of unique passwords generated with restrictions for multiple accounts when the number of accounts is small, the memorability for the multiple passwords decreases as the number of possible accounts increases. One way to improve the memorability of passwords for multiple accounts is to have users generate them several times, at different points of time, prior to allowing them to exit the system.