Human Selection of Mnemonic Phrase-based Passwords

DMCA

Human Selection of Mnemonic Phrase-based Passwords (2006)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Cynthia Kuo

Venue:	in SOUPS ’06: Proceedings of the Second Symposium on Usable Privacy and Security
Citations:	54 - 7 self

BibTeX

@INPROCEEDINGS{Kuo06humanselection,
    author = {Cynthia Kuo},
    title = {Human Selection of Mnemonic Phrase-based Passwords},
    booktitle = {in SOUPS ’06: Proceedings of the Second Symposium on Usable Privacy and Security},
    year = {2006},
    pages = {67--78},
    publisher = {ACM Press}
}

OpenURL

Abstract

Textual passwords are often the only mechanism used to authenticate users of a networked system. Unfortunately, many passwords are easily guessed or cracked. In an attempt to strengthen passwords, some systems instruct users to create mnemonic phrase-based passwords. A mnemonic password is one where a user chooses a memorable phrase and uses a character (often the first letter) to represent each word in the phrase. In this paper, we hypothesize that users will select mnemonic phrases that are commonly available on the Internet, and that it is possible to build a dictionary to crack mnemonic phrase-based passwords. We conduct a survey to gather user-generated passwords. We show the majority of survey respondents based their mnemonic passwords on phrases that can be found on the Internet, and we generate a mnemonic password dictionary as a proof of concept. Our 400,000-entry dictionary cracked 4 % of mnemonic passwords; in comparison, a standard dictionary with 1.2 million entries cracked 11 % of control passwords. The usergenerated mnemonic passwords were also slightly more resistant to brute force attacks than control passwords. These results suggest that mnemonic passwords may be appropriate for some uses today. However, mnemonic passwords could become more vulnerable in the future and should not be treated as a panacea.

Keyphrases

mnemonic password mnemonic phrase-based password human selection control password user-generated password textual password many password us today mnemonic phrase first letter survey respondent networked system mnemonic password dictionary force attack usergenerated mnemonic password standard dictionary memorable phrase

DMCA