Integrating Visual Mnemonics and Input Feedback With Passphrases to Improve the Usability and Security of Digital Authentication

Abstract

Objective:

We developed a new authentication system based on passphrases instead of passwords. Our new system incorporates a user-generated mnemonic picture displayed during login, definition tooltips, error correction to reduce typographical errors, a decoy-based input masking technique, and random passphrase generation using either a specialized wordlist or a sentence template.

Background:

Passphrases exhibit a greater level of security than traditional passwords, but their wider adoption has been hindered by human factors issues. Our assertion is that the added features of our system work particularly well with passphrases and help address these shortcomings.

Method:

We conducted a study to evaluate our new system with a customized 1,450-word list and our new system with a 6-word sentence structure against the control conditions of a user-created passphrase of at least 24 characters and a system-generated passphrase using a 10,326-word list. Fifty participants completed two sessions so that we could measure the usability and security of the authentication schemes.

Results:

With the new system conditions, memorability was improved, and security was equivalent to or better than the control conditions. Usability and overall ratings also favored the new system conditions over the control conditions.

Conclusion:

Our research presents a new authentication system using innovative techniques that improve on the usability and security of existing password and passphrase authentication systems.

Application:

In computer security, drastic changes should never happen overnight, but we recommend that our contributions be incorporated into current authentication systems to help facilitate a transition from passwords to usable passphrases.

Keywords

cybersecurity usability passwords passphrases mnemonics

Introduction

The idea of a passphrase, or phrase-based password, can be seen as an extension to the traditional passwords used in digital authentication. They fulfill the same role as a secret that the user demonstrates to the system that he or she knows to prove personal identity (Renaud, 2005). Therefore, like passwords but unlike other proposed replacements for passwords such as tokens or biometrics (Whitten & Tygar, 1999), passphrases should also prove to be easy to implement, easy for users to understand, and easy for users to recover when locked out (Herley & van Oorschot, 2012).

The fundamental feature of passphrases is that they are longer than traditional passwords. The primary motivation for this change is to increase the level of security, particularly against brute-force attacks, which occur when an automated attack is conducted not by making informed guesses but by exhaustively trying all the possible permutations in a given password space (Herley & van Oorschot, 2012). As the price for large quantities of distributed computing power becomes increasingly affordable, making brute-force attacks more viable, there is renewed interest in moving from shorter passwords to longer passphrases (Burr, Dodson, & Polk, 2006). Using a data set of 12,000 actual passwords and passphrases, Kelley et al. (2012) found that a simple passphrase policy of “anything at least 16 characters long” was much stronger than any policy requiring at least 8 characters plus all the restrictions (e.g., character types, repeated characters, dictionary checks) commonly found today.

From a human factors standpoint, the key benefit of passphrases is that they allow the secret to be much less complex than passwords with onerous character type requirements and thus still memorable (Yan, Blackwell, Anderson, & Grant, 2004). Komanduri et al. (2011) determined that the most effective combination of memorability and security resulted from simple passphrases with no other restrictions.

However, memorability is not the only factor in the usability of passphrases. Keith, Shao, and Steinbart (2007) tested user-created passphrases and found that while the memorability of the passphrases themselves was no better or worse than that of passwords, login success rate was significantly lower because of a marked increase in typographical errors. This finding suggests that combining passphrases with techniques that reduce errors made while entering passwords, as discussed by Juang and Greenstein (2011), could mitigate this effect.

Kuo, Romanosky, and Cranor (2006) evaluated the security of user-created passphrases and found that the security benefit of this group of passphrases was lower than the security community expected. This was because, as human factors would predict, users frequently selected weak phrases based on sources such as song lyrics, literature, movies, or television shows. This research recommended the possibility of using system-generated passphrases—an example being the system-generated phrases from Juang, Ranganayakulu, and Greenstein (2012)—instead of user-created ones.

One of the most popular recommendations in the online security community for creating system-generated passphrases is Reinhold’s (2012) Diceware, first demonstrated in 1995. This system utilizes a wordlist containing 7,776 words—not all of which can be found in an English dictionary—and suggests that the user rolls five physical dice to determine each word in the passphrase; Reinhold (2012) recommends using five words (i.e., 25 rolls) in each passphrase for future-proof security. An example Diceware passphrase would be lares ave ghent henna clio.

Observations among security professionals indicated that Diceware did not see much use in practice during the years following its creation, and little research was initially conducted about the usability of the system. As a result, Leonhard and Venkatakrishnan (2007) tested the usability of Diceware passphrases containing just three words each. They found that Diceware performed poorly, with users rating their satisfaction with their passphrase at 1.71 out of 5. Because the wordlist was so large, individual words often proved difficult, suggesting that perhaps using a smaller wordlist would produce more memorable passphrases.

To examine the effect of different wordlists on randomly generated passphrases, Shay et al. (2012) conducted a study using 1,476 online participants and a variety of system-generated passphrase conditions, including passphrases with wordlists of size 181, 401, and 1,024 consisting of three and four words. There was found to be little difference between wordlists of these sizes. Success was affected more by limiting the number of characters in the passphrase rather than the number of words, reflecting the typographical errors found by Keith et al. (2007). Interestingly, the Diceware wordlist minimizes typos by prioritizing short words, with an average of 4.3 characters each (Reinhold, 2012).

Despite any usability issues Diceware may have, as well as its failure to gain traction with typical users, Diceware has started to see some implementation in security-conscious circles. Diceware has been used since 2012 by the leading privacy-focused search engine DuckDuckGo to store user settings, and it is recommended by the password manager 1Password to create the master password (Shiner, 2013). The recent use of Diceware mirrors the general need to switch to passphrases from passwords for increased security.

Shay et al. (2012) recommended that perhaps the most promising area for improving memorability of passphrases lies in asking users to construct a scene or story relating to their passphrase. Fraune, Juang, Greenstein, Chalil Madathil, and Koikkara (2013) found that asking users to create a mnemonic picture to assist them with system-generated passphrases did improve the level of usability of those passphrases.

The challenge, then, is to design an authentication system that benefits from the security of randomly generated passphrases while avoiding the poor usability that would prevent its acceptance by users.

Implementation

Our goal was to develop a new system-generated passphrase authentication system that incorporated the three major contributions from our previous work: a specialized wordlist and sentence template (Juang et al., 2012), a user-created mnemonic picture that provides cued recall (Fraune et al., 2013), and a decoy-based input masking technique (Juang & Greenstein, 2011). Along with word definition tooltips and error correction (also known as autocorrect) to reduce typographical errors, we expected that this new system would prove particularly well suited to passphrases.

The basis for our system was the automated mnemonic phrase generator from Juang et al. (2012). These phrases were designed to use only simple vocabulary and grammar and to make meaningful sense, as in the example Jill’s pet wolf just ate our pizzas (see Figure 1). By imposing a structure of animals performing actions, we are able to suggest a mental scene in seven words that is more memorable than a collection of random words. The purpose of the mnemonic phrase in our previous work was to help the user recall an assigned password.

Figure 1.

The system-generated phrase is designed to be simple.

Unlike in our previous work, the generated phrase itself is now the authentication secret. As a result, the design of the wordlist must be changed to effect the security enhancements of a passphrase. It proved to be a delicate balance to expand the size of the wordlist to increase security while ensuring that the usability of the system was not degraded. Our guiding principle was to maintain the usage of simple words.

The new passphrase structure is based on the existing seven-word sentence structure from Juang et al. (2012). Keeping with the theme of animals performing actions, the associated wordlist was manually expanded beyond the original 26 animals, 26 adjectives, 26 actions, 26 foods, and so forth. Since English speakers know comfortably many more than 26 each of these types of words, we found that we were able to maintain the usage of simple words while increasing the level of security. In fact, we were even able to eliminate the need for one of the words, resulting in a new six-word sentence structure with varying numbers of possibilities for the different word positions. The final result is a passphrase such as silly pet wolf ate our pizzas.

We also wanted to explore an alternative approach to passphrase generation that improved on the standard Diceware wordlist (Reinhold, 2012), which is used to generate a passphrase by randomly selecting several words that can all be used in any position in the phrase. Although different types of words are in the wordlist, the permutation of words is not guaranteed or expected to make semantic or even grammatical sense.

After a survey of options, we decided to start with the 1,510-word Special English list (Kelly, 2010). This wordlist was created in 1959 by Voice of America (VOA), the official external broadcaster of the U.S. government, and has been updated regularly since. It is aimed at international listeners and English learners. We then pilot tested the wordlist to filter out 60 problematic words.

Since users may not like a particular randomly generated passphrase but allowing them to keep generating an unlimited number of phrases would be far less secure, we decided to allow users to see four randomly selected passphrases (e.g., succeed complete murder aid, weak parade of chemistry, point local instrument pain, and weigh in jewel girl) and then choose the passphrase out of the four with which they were most comfortable.

To ensure that users understood the words used in any of our wordlists, we provided simple dictionary definitions for each word. These are implemented as tooltips that appear when the word is hovered over.

Another one of the contributions from our previous work is the use of user-created mnemonic pictures to facilitate password memorization (Fraune et al., 2013), as shown in Figure 2. During account creation, when a randomly generated passphrase is displayed, a simple paint program is also opened by the system. The user then draws a personal visual reminder, of any size, in the paint program. This picture is displayed back to the user when he or she attempts to sign in later.

Figure 2.

The system-generated phrase and picture complement each other as simple, effective memory aids.

The generation effect demonstrates that creating cues oneself rather than combining pieces of information together can increase recall (Craik & Tulving, 1975). Because the generation effect works only for the person who created the picture (Bertsch, Pesta, Wiscott, & McDaniel, 2007), our method should improve password recall while maintaining the same level of security, which was supported by the findings of Fraune et al. (2013).

The final major contribution from our previous work is the decoy-based input masking technique from Juang and Greenstein (2011) that hides login input in plain sight using decoys. The purpose of any input masking technique—the most prevalent example being bullets substituted for characters—is to protect against shoulder surfers: human attackers who attempt to watch a user’s screen or keyboard to steal sensitive input as it is being entered.

As seen in Figure 3 (which demonstrates the system using passwords instead of passphrases), we can accomplish this without needing to alter the display of the sensitive input itself. Instead, we use the addition of system-generated superfluous input (decoys) to surround and mask legitimate input. We found that decoy-based input masking shared the same level of security as bullet masking or even displaying nothing on screen while sharing the same level of usability as displaying the passwords in cleartext (i.e., no masking whatsoever) (Juang & Greenstein, 2011).

Figure 3.

The correct password is obfuscated with decoys in real time as it is entered.

For decoy-based input masking to function appropriately with passphrases instead of passwords, the decoys are now drawn from other words in the wordlist. The system can also detect what has been typed so far and identify a shoulder surfing attack by noticing an in-progress typed decoy, even if that decoy is never actually submitted as a login attempt. The system would then lock out and record the attacker and alert the legitimate user of the shoulder surfing attack.

We were also able to improve the usability of logging in with our new authentication system by the use of error correction (i.e., automatic spell checking). Because the wordlists we use are tremendously smaller than a wordlist found in a word processor or web browser, our system is able to correct to the intended word more aggressively and accurately. Because we correct to both legitimate words and decoys with equal weight, the security of our new system remains unaffected.

Method

The following conditions were selected to fulfill 40 bits of entropy, a commonly used level of security for passwords protecting valuable resources (Biancuzzi, 2006; Hruska, 2011; Shiner, 2013); for critical applications, the level of security can be enhanced further through a technique called key stretching: repeated password hashing designed to increase computation time (Percival, 2009). The first two study conditions represent the most common and recommended currently available passphrase systems, and the last two represent our new system using two different wordlists:

1. A user-generated passphrase of at least 24 characters (including spaces) with no other restrictions (see Figure 4). No mnemonics are used, and the input masking is standard bullet masking. $(\begin{array}{l} 24 t o t a l c h a r a c t e r s = 1 c h a r a c t e r \times 4 b i t s + \\ 7 c h a r a c t e r s \times 2 b i t s + 12 c h a r a c t e r s \times 1.5 b i t s + \\ 4 c h a r a c t e r s \times 1 b i t = 40.0 b i t s o f e n t r o p y \end{array})$ (Burr et al., 2006).

Figure 4.

The user-generated passphrase condition appears similar during creation and login.

2. A system-generated passphrase utilizing three words drawn randomly without replacement from the Diceware8k list (Reinhold, 2012) supplemented with Beale’s alternate list (Reinhold, 2012) and the shortest words from the 1Password expanded English Diceware list (Shiner, 2013), totaling 10,326 unique words (see Figure 5), namely, “Diceware10k.” No mnemonics are used, and the input masking is standard bullet masking. $(\begin{array}{l} 3 w o r d s \times l o g_{2} 10326 p o s s i b l e \\ w o r d s = 40.0 b i t s o f e n t r o p y \end{array}) .$

Figure 5.

The Diceware10k system-generated passphrase condition results in shorter passphrases.

3. A passphrase chosen from a set of four system-generated passphrases, each utilizing four words drawn randomly without replacement from an abridged version of the Special English list (Kelly, 2010) containing 1,450 words with definition tooltips (see Figure 6). A user-created mnemonic picture is shown during login, error correction is enabled, and the input masking is decoy masking. $(\begin{array}{l} 4 w o r d s \times \log_{2} 1450 p o s s i b l e w o r d s - \log_{2} 4 \\ c h o i c e s = 40.0 b i t s o f e n t r o p y \end{array}) .$

Figure 6.

The Special English wordlist condition allows the user to select one of four passphrases.

4. A system-generated passphrase utilizing a six-word sentence structure with a varying number of possible drawn words for each location (see Figure 7). A user-created mnemonic picture is shown during login, error correction is enabled, and the input masking is decoy masking. $(\begin{array}{l} \log_{2} (151 \times 151 \times 155 \times 61 \times 78 \times 66) p o s s i b l e \\ c o m b i n a t i o n s = 40.0 b i t s o f e n t r o p y \end{array}) .$

Figure 7.

The six-word sentence condition shows the mnemonic picture when selected by the user.

Dependent Variables

The data for these objective measures were recorded by the system: recall time; Jaro-Winkler proximity (i.e., the similarity or correlation between the guess of a passphrase and the actual stored passphrase, normalized such that 0 indicates complete dissimilarity and 1 indicates equality) (Winkler, 1990) for recall effectiveness, shoulder surfing security, and cracking security; recall success; shoulder surfing resist success, based on guesses by onlooking human attackers; cracking resist success, based on guesses by human attackers; cracking resist attempts (i.e., the number of attempts taken by a machine to crack the passphrase).

These subjective measures were also recorded by the system: creation and recall NASA Task Load Index (NASA-TLX) (Hart & Staveland, 1988), creation and recall System Usability Scale (SUS) scores (Brooke, 1996), perceived level of security on a 7-point Likert scale, and overall rating on a 7-point Likert scale.

Participants

We recruited a fairly diverse set of 52 participants (28 males, 24 females), ranging from age 20 to 61 (M = 29), via word of mouth and e-mail. Fifty of our participants returned between 7 and 11 days later for a second session; the other 2 participants were lost to attrition. The 50 participants who returned were each compensated with a $20 gift card for completing our study. The study utilized a within-subjects design where each participant received each condition. All participants were assigned to conditions based on a balanced Latin square.

This research complied with the American Psychological Association Code of Ethics and was approved by the Institutional Review Board at Clemson University. Informed consent was obtained from each participant.

Procedure

Participants were greeted and given a brief overview of the study. They were then given five minutes per condition to create a passphrase and any applicable mnemonics, with a one-minute warning given after four minutes had elapsed. After completing the creation phase for each condition, participants completed NASA-TLX and SUS questionnaires.

Participants then moved to the recall phase, where they signed in to the four accounts they had created in a random order within a maximum of five attempts per account. After each condition, participants again completed NASA-TLX and SUS questionnaires, this time regarding the recall task. They were also asked to provide a rating for the perceived level of security and an overall assessment for each condition.

Participants were instructed not to write down their passphrases after creating them. A week after each participant’s first session, he or she was invited back for a second session to repeat the recall process.

At the end of the recall phase of the second session, for which the procedure was largely identical to the recall phase of the first session, participants were also tasked with attempting to guess the passphrases of four other accounts as closely as possible. The system treated these adversaries in exactly the same manner as ordinary users.

Finally, participants took on the role of attackers to assess the security of the conditions against shoulder surfing. After observing another user entering his or her passphrase—being allowed during that time to see the mnemonic picture if applicable—the attacker was then asked to enter their best guess of the user’s passphrase.

Results

Data Analysis

A repeated measures one-way ANOVA with a 95% confidence interval was used to determine significance for measures across sessions. Welch’s correction was used when variances were heterogeneous, which was determined using Levene’s test. Mauchly’s test was used to check for sphericity; the Greenhouse-Geisser correction was applied when violated. Log transformations were applied to recall time and cracking resist attempts to achieve normality.

Given significant results, Tukey’s HSD test showed which authentication schemes differed significantly from one another; the Games-Howell test was used when variances were heterogeneous. A simple effects test was used to evaluate any possible interactions involving condition and session—however, no interaction effects were found for any of the measures.

Recall success was analyzed using a generalized estimating equation to examine the longitudinal effect across sessions. Shoulder surfing resist success, cracking resist success, and individual session recall success were analyzed using a binary logistic regression.

Machine Cracking

Because the currently available industry standard password crackers are known to perform poorly against passphrases (Rao, Jha, & Kini, 2013), we ended up using a simple deterministic passphrase cracker prioritizing more commonly used words, trained on an exact wordlist derived from the actual words utilized by study participants. This passphrase cracker will always first attempt the combination of all the most common words for each position and then proceed to guess the next most likely combination and repeat until the entire passphrase space is exhausted.

Objective Measures

Efficiency

The results indicate a significant difference for first-session recall time, F(3, 204) = 8.99, p < .001, η² = .087. The recall time in seconds was shorter for Special English (M = 28.9) than all other conditions: M(user-generated) = 46.3, M(Diceware10k) = 53.8, M(sentence) = 53.4. For the second session, there was no significant difference for recall time, F(3, 196) = 1.88, p = .138, η² = .025. The average recall time in seconds for Special English increased from before (M = 44.9) but remained the shortest condition: M(user-generated) = 47.8, M(Diceware10k) = 59.4, M(sentence) = 53.7.

Effectiveness

The differences in recall Jaro-Winkler proximity between the passphrase entered by the user and the actual passphrase were statistically significant for both the first session, F(3, 204) = 4.16, p = .008, η² = .059, and second session, F(3, 196) = 9.96, p < .001, η² = .147. For the first session, Special English (M = .990) and sentence (M = .985) were both significantly closer than Diceware10k (M = .898) but not user-generated (M = .925). For the second session, Special English (M = .956) and sentence (M = .955) were again both significantly closer than Diceware10k (M = .764) but not user-generated (M = .859).

The effect of passphrase on success was also determined to be statistically significant for both the first session, χ²(3) = 20.4, p < .001, and second session, χ²(3) = 36.0, p < .001. Special English and sentence significantly outperformed user-generated and Diceware10k. Figure 8 shows that the first-session success rate was 94.2% for Special English, 92.3% for sentence, 76.9% for user-generated, and 65.4% for Diceware10k, while the second-session success rate was 82.0% for sentence, 80.0% for Special English, 50.0% for user-generated, and 34.0% for Diceware10k.

Figure 8.

Decrease in recall success rate from first session (light) to second session (dark).

Security

For security against shoulder surfers, there was no significant effect for the Jaro-Winkler proximity between the passphrase entered by shoulder surfers and the actual passphrase, F(3, 196) = 2.14, p = .097, η² = .032; M(user-generated) = .596; M(Diceware10k) = .627; M(Special English) = .523; M(sentence) = .589. No passphrase was guessed correctly, so the shoulder surfing resist success rate was 100% for all conditions.

For cracking security against human attackers, there was a statistically significant difference for the Jaro-Winkler proximity between guesses and the actual passphrases, F(3, 196) = 19.5, p < .001, η² = .230. Diceware10k (M = .404) and user-generated (M = .457) were farther than both Special English (M = .568) and sentence (M = .589). Again, no passphrase was guessed correctly, so the cracking resist success rate was 100% for all passphrases.

For cracking security against machine attackers, the effect of passphrase on the log₂-transformed cracking resist attempts was found to be statistically significant, F(3, 196) = 78.1, p < .001, η² = .632. Special English (M = 36.0), sentence (M = 34.6), and Diceware10k (M = 34.4), the system-generated conditions, all took a greater number of attempts to crack on average than the user-generated condition (M = 23.8).

Subjective Measures

Workload

For the creation task, there was no significant effect of condition on any of the NASA-TLX indices. During the first recall session, the only index that was statistically significant was mental demand, F(3, 204) = 3.44, p = .019, η² = .049. Special English (M = 2.29) was rated as being significantly less mentally demanding than Diceware10k (M = 3.60), M(user-generated) = 2.79, and M(sentence) = 3.04. For the second recall session, there was no significant effect of condition on any of the indices, including mental demand, F(3, 196) = 2.18, p = .092, η² = .032.

Usability

During the creation task, there was no significant effect of condition on SUS, F(3, 204) = 1.50, p = .216, η² = .022; M(user-generated) = 73.9, M(Diceware10k) = 69.6, M(Special English) = 67.2, M(sentence) = 66.8. For first-session recall, the effect of condition on SUS was significant, F(3, 204) = 4.29, p = .007, η² = .058. Special English (M = 72.9) was rated as significantly more usable than Diceware10k (M = 59.9) and user-generated (M = 58.0) but not sentence (M = 68.7). As seen in Figure 9, the effect of condition on SUS was also significant for second-session recall, F(3, 196) = 7.62, p < .001, η² = .110. Sentence (M = 76.0) and Special English (M = 71.7) were both considered more usable than user-generated (M = 56.0). Sentence was also found to be significantly more usable than Diceware10k (M = 62.1).

Figure 9.

Recall System Usability Scale (SUS) score (larger values indicate an increase in usability).

Security

There was no significant difference for the effect of condition on perceived level of security, F(3, 196) = 0.638, p = .591, η² = .010; M(user-generated) = 5.44, M(Diceware10k) = 5.12, M(Special English) = 5.42, M(sentence) = 5.52.

Overall

There was a significant difference for the effect of condition on overall rating, F(3, 196) = 9.73, p < .001, η² = .130. Special English (M = 5.02), sentence (M = 4.98), and user-generated (M = 4.88) were all rated more highly overall than Diceware10k (M = 3.52).

Discussion

The results indicate that the recall effectiveness measures were most favorable for the new system conditions, with second-session recall success rates of 82% for sentence and 80% for Special English, compared to 50% for user-generated and 34% for Diceware10k. For the new system conditions, higher success rates were likely due in large part to the login benefits of error correction and decoy masking. These features address the increased susceptibility of passphrases to typographical errors (Keith et al., 2007).

Nevertheless, success rates around 80% would not initially seem to inspire tremendous confidence in the practicality of real-world implementation. However, for the sake of experimental design, we intended for our tasks to be more difficult than in typical scenarios. Participants were tasked to create four accounts in a row (resulting in interference between passphrases), were told not to write down or practice their passphrases, and were not incentivized for higher performance. Therefore, we believe that in standard real-world situations, long-term success rates for our new system would increase past the 80% level. Studying performance in the wild versus in a laboratory setting would be important for assessing ecological validity.

We found that shoulder surfing security measures did not differ between authentication schemes. This suggests that the high level of shoulder surfing security of decoy masking was preserved through the transition from passwords to passphrases.

The results indicate that cracking security measures against machine attackers were least favorable overall for the user-generated condition. User-generated was found to take 2²⁴ attempts on average, over 10 bits less secure (i.e., 1,000 times fewer attempts) than any other condition.

For cracking security against human attackers, the Jaro-Winkler proximity suggests that user-generated and Diceware10k performed better than Special English and sentence; in other words, the mnemonic pictures leaked some information to attackers. However, the average proximity for all conditions fell between a narrow range of .4 to .6. Consequently, attackers were farther away from guessing the legitimate passphrase while using the pictures of the new system conditions (M = .579) than they were even while shoulder surfing and hindered by the bullet masking of the control system conditions (M = .611).

We found that subjective usability measures were least favorable for both Diceware10k and user-generated as both performed worse than the new system conditions for first-session and second-session recall SUS. This was surprising to us because users typically prefer to create their own passwords or passphrases (Proctor, Lien, Vu, Schultz, & Salvendy, 2002). Since there were no significant differences for creation SUS, it is likely that recall SUS was highly affected by lower performance for the control system conditions in the recall tasks. While Shay et al. (2012) found that participants generally rated system-generated passphrases as difficult and annoying, we believe that the mnemonic pictures, error correction, and decoy masking greatly improved the usability of our new passphrase authentication system.

Despite the advantages of passphrases over traditional passwords, adoption by the general public has not matched the predictions of security researchers (Herley & van Oorschot, 2012). The usability of conventional passphrases has been found to be lacking (Leonhard & Venkatakrishnan, 2007), which often keeps away the very users who would benefit most. More usable passphrases would be a major step toward narrowing that gap.

Security researchers have predominantly hailed from a technical background. There has certainly been an increased focus on usability in recent years, but the fact that users create insecure passphrases (Kuo et al., 2006) would not be a surprise to those with an understanding of human factors principles. Instead of continuing to create difficult-to-follow tips for users to create more secure passwords and passphrases (thus having to juggle both usability and security), we should embrace the idea that it would be better to provide secure passphrases and allow users to focus on what they do best: making things easier for themselves.

Conclusion

We recommend that current authentication systems be improved by incorporating the features from our new passphrase system. By adopting a human factors lens and addressing shortcomings of existing passphrase systems—that the increased length of passphrases can lead to difficulty recalling and inputting them—we would be able to effect more secure practice instead of placing the blame on end users.

Key Points

We developed a new passphrase authentication system that seeks to address human factors issues that have slowed passphrase adoption.

Our new authentication system focuses on usability by employing user-generated mnemonic pictures, error correction to mitigate typographical errors, and a decoy-based input masking technique.

We conducted a study comparing our new system using each of two sentence structures against the two most commonly used existing passphrase systems: a user-generated passphrase and a system-generated passphrase using a large wordlist.

Study results indicate that our new system improved on the usability and security of existing password and passphrase authentication systems.

Footnotes

ORCID iD

Kevin Juang

Kevin Juang is a user experience research manager at SunTrust Bank. He obtained his PhD in industrial engineering in 2014 from Clemson University.

Joel Greenstein is an associate professor emeritus of industrial engineering at Clemson University and an HFES fellow. He obtained his PhD in mechanical engineering in 1979 from the University of Illinois at Urbana-Champaign.

References

Bertsch

Pesta

B. J.

Wiscott

McDaniel

M. A

. (2007). The generation effect: A meta-analytic review. Memory & Cognition, 35(2), 201–210.

Biancuzzi

. (2006, February 22). John the Ripper 1.7, by Solar Designer. Retrieved from http://www.securityfocus.com/columnists/388/2

Brooke

. (1996). SUS: A “quick and dirty” usability scale. In Jordan

P. W.

Thomas

Weerdmeester

B. A.

McClelland

A. L.

(Eds.), Usability evaluation in industry (pp. 189–194). London: Taylor and Francis.

Burr

W. E.

Dodson

D. F.

Polk

W. T

. (2006). Electronic authentication guideline: Recommendations of the National Institute of Standards and Technology. Gaithersburg, MD: U.S. Department of Commerce, Technology Administration, National Institute of Standards and Technology.

Craik

F. I. M.

Tulving

. (1975). Depth of processing and the retention of words in episodic memory. Journal of Experimental Psychology: General, 104(3), 268–294.

Fraune

M. R.

Juang

K. A.

Greenstein

J. S.

Chalil Madathil

Koikkara

. (2013). Employing user-created pictures to enhance the recall of system-generated mnemonic phrases and the security of passwords. Proceedings of the 57th Annual Meeting of the Human Factors and Ergonomics Society (pp. 419–423). Santa Monica, CA: Human Factors and Ergonomics Society.

Hart

S. G.

Staveland

. (1988). Development of NASA-TLX: Results of empirical and theoretical research. In Hancock

P. A.

Meshkati

(Eds.), Human mental workload (pp. 239–250). Amsterdam, Netherlands: North-Holland Press.

Herley

van Oorschot

P. C

. (2012). A research agenda acknowledging the persistence of passwords. IEEE Security & Privacy, 10(1), 28–36.

Hruska

. (2011, November 3). How to calculate password strength. Retrieved from http://cubicspot.blogspot.com/2011/11/how-to-calculate-password-strength.html

10.

Juang

K. A.

Greenstein

J. S

. (2011). Evaluating the usability and security of input masking techniques. Proceedings of the 55th Annual Meeting of the Human Factors and Ergonomics Society (pp. 1120–1124). Santa Monica, CA: Human Factors and Ergonomics Society.

11.

Juang

K. A.

Ranganayakulu

Greenstein

J. S

. (2012). Using system-generated mnemonics to improve the usability and security of password authentication. Proceedings of the 56th Annual Meeting of the Human Factors and Ergonomics Society (pp. 506–510). Santa Monica, CA: Human Factors and Ergonomics Society.

12.

Keith

Shao

Steinbart

P. J

. (2007). The usability of passphrases for authentication: An empirical field study. International Journal of Human-Computer Studies, 65(1), 17–28.

13.

Kelley

P. G.

Komanduri

Mazurek

M. L.

Shay

Vidas

Bauer

. . . Lopez

. (2012). Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. Proceedings of the 2012 IEEE Symposium on Security and Privacy (pp. 523–537). Piscataway, NJ: IEEE.

14.

Kelly

. (2010). VOA Special English word book. Retrieved from http://www.manythings.org/voa/words.htm

15.

Komanduri

Shay

Kelley

P. G.

Mazurek

M. L.

Bauer

Christin

Egelman

. (2011). Of passwords and people: Measuring the effect of password-composition policies. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 2595–2604). New York, NY: ACM.

16.

Kuo

Romanosky

Cranor

L. F

. (2006). Human selection of mnemonic phrase-based passwords. Proceedings of the Second Symposium on Usable Privacy and Security (pp. 67–78). New York, NY: ACM.

17.

Leonhard

M. D.

Venkatakrishnan

V. N

. (2007). A comparative study of three random password generators. IEEE International Conference on Electro/Information Technology 2007 (pp. 227–232). Piscataway, NJ: IEEE.

18.

Percival

. (2009). Stronger key derivation via sequential memory-hard functions. Proceedings of BSDCan 2009 (pp. 1–16). Ottawa: BSDCan.

19.

Proctor

R. W.

Lien

M. C.

K. P. L.

Schultz

E. E.

Salvendy

. (2002). Improving computer security for authentication of users: Influence of proactive password restrictions. Behavior Research Methods, Instruments & Computers, 34(2), 163–169.

20.

Rao

Jha

Kini

. (2013). Effect of grammar on security of long passwords. Proceedings of the Third ACM Conference on Data and Application Security and Privacy (pp. 317–324). New York, NY: ACM.

21.

Reinhold

. (2012). The Diceware passphrase home page. Retrieved from http://world.std.com/~reinhold/diceware.html

22.

Renaud

. (2005). Evaluating authentication mechanisms. In Cranor

L. F.

Garfinkel

(Eds.), Security and usability (pp. 103–128). Sebastopol, CA: O’Reilly.

23.

Shay

Kelley

P. G.

Komanduri

Mazurek

M. L.

Vidas

. . . Cranor

L. F

. (2012). Correct horse battery staple: Exploring the usability of system-assigned passphrases. Proceedings of the Eighth Symposium on Usable Privacy and Security (Article No. 7). New York, NY: ACM.

24.

Shiner

. (2013). On hashcat and strong master passwords as your best protection. Retrieved from http://blog.agilebits.com/2013/04/16/1password-hashcat-strong-master-passwords/

25.

Whitten

Tygar

J. D

. (1999). Why Johnny can’t encrypt: A usability evaluation of PGP 5.0. Proceedings of the 8th USENIX Security Symposium (pp. 169–184). Retrieved from https://www.usenix.org/conference/8th-usenix-security-symposium/why-johnny-cant-encrypt-usability-evaluation-pgp-50

26.

Winkler

W. E

. (1990). String comparator metrics and enhanced decision rules in the Fellegi-Sunter model of record linkage. Proceedings of the Section on Survey Research Methods (pp. 354–359). Alexandria, VA: American Statistical Association.

27.

Yan

Blackwell

Anderson

Grant

. (2004). Password memorability and security: Empirical results. IEEE Security & Privacy, 2(5), 25–31.