Citation Context

...cking strong passwords. Despite a litany of proposed “password replacements” over the past decades, no system has proven superior to text passwords when evaluated according to a broad set of criteria =-=[7, 20]-=-. However, the fact remains that users tend to choose predictable passwords [6,15] and reuse the same passwords across multiple accounts [17]. Despite warnings to the contrary, many users also write t...

Citation Context

...chemes, including the lack of need for custom hardware, ease of deployment and incorporation with existing services, their simplicity, and lack of need to memorize or store complex cryptographic keys =-=[22]-=-. A large body of research has been conducted in understanding the security of user-created passwords. For example, there has been studies that look into understanding users’ reaction to visual and te...

Citation Context

...s, hardware tokens, and federated identity; however, text passwords remain the dominant mechanism for authenticating people to computers, and seem likely to remain that way for the foreseeable future =-=[5,23]-=-. Better understanding of text passwords therefore remains important. Considerable effort has been spent studying the usage and characteristics of passwords (e.g., [13, 17, 34, 35, 45]), but password ...

Citation Context

...ar future, as the alternatives are still immature or economically infeasible. Moreover, passwords offer advantages not always matched by other schemes, including usability and easy recovery from loss =-=[1]-=-. Even after half a century of password use in computing, we still do not have a deep understanding of how people create their passwords. Such an understanding is desirable, as it can inform more real...

Citation Context

...r poor security, yet here we are, four decades after the invention of public-key cryptography and two decades into the history of the web, and we still use passwords. A recent study by Bonneau et al. =-=[5]-=- sheds some light onto why that is the case: none of the 35 studied password-replacement mechanisms are sufficiently usable or deployable in practice to be considered a serious alternative or augmenta...

Citation Context

...28, 19], and passwords based on implicit learning [23]. These user studies have been limited in duration and scope (e.g., study retention of a single password over a short period of time). Other work =-=[25]-=- articulates informal, but more comprehensive, usability criteria for password schemes. Our use of cued recall is driven by evidence that it is much easier than pure recall [17]. We also exploit the l...

Citation Context

...ovide some protection against phishing attacks. Add cloud-based synchronization across devices, and password managers promise tremendous security and usability benefits at minimal deployability costs =-=[10]-=-. Given these advantages, the popular media often extols the security advantages of modern password managers (e.g., CNET [11], PC Magazine [30], and New York Times [34]). Even technical publications, ...

Citation Context

...of finding something better, user familiarity as an authentication front-end (passwords will likely persist as one factor within multidimensional frameworks), and the inertia of ubiquitous deployment =-=[9, 30]-=-. Thus the challenges of administering passwords will not fade quietly either, to the disappointment of those hoping that a replacement technology will remove the need to address hard issues. 2 Classi...

Citation Context

...ropy, which can be as low as 10 bits or fewer [18]. By contrast, with random passwords we can easily provide strong bounds of the difficulty of guessing, if not other attack vectors against passwords =-=[20]-=-. 2.1 The cost of brute-force Random passwords are primarily a defense against an offline attack (eq. brute-force attack), in which the attacker is capable of trying as many guesses as they can afford...