Promoting Memorability and Security of Passwords Through Sentence Generation

Abstract

Much of our personal information flows through the Internet as we receive online services or make online transactions, making it essential to have reliable security systems to protect against information theft, denial of service, and fraud. The most commonly used method for authentication and identification is entering the username-password combination. However, this method is weak because users select passwords that are easy to remember and easy to crack. We evaluated a sentence-generation method designed to improve recall and security. The sentence-generation method produced crack-resistant passwords when the users were instructed to embed a digit and special character into the sentence (and password). However, the requirements of including a digit and special character also resulted in a cost in the memorability of the password. An analysis of errors identified three areas of research that may develop techniques that promote better recall of passwords using this sentence-generation method.

Get full access to this article

View all access options for this article.

References

Brewer

(1977). Memory for the pragmatic implications of sentences. Memory & Cognition, 5, 673–678.

Craik

F. I. M.

Lockhart

R. S.

(1972). Levels of processing: A framework for memory research. Journal of Verbal Learning and Verbal Behavior, 11, 671–684.

Craik

F. I. M.

Tulving

(1975). Depth of processing and the retention of words in episodic memory. Journal of Experimental Psychology: General, 104, 269–294.

Jacoby

L. L.

Craik

F. I. M.

(1979). Effects of elaboration of processing at encoding and retrieval: Trace distinctiveness and recovery of initial context. In Cermak

L. S.

Craik

F. I. M.

(Eds.), Levels of processing in human memory (pp. 1–21). Hillsdale, NJ: Lawrence Erlbaum.

Klein

(1990). Foiling the cracker: A survey of, and improvements to, password security. Proceedings of the USENIX Security Workshop.

Parkin

A. J.

(1984). Levels of processing, context, and facilitation of pronunciation. Acta Psychologia, 55, 19–29.

Proctor

R. W.

Lien

M. C.

K.-P. L.

Schultz

E. E.

Salvendy

(2002). Improving computer security for authentication of users: Influence of proactive password restrictions. Behavior Research Methods, Instruments, & Computers, 34, 163–169.

Riddle

B. L.

Miron

M. S.

Semo

J. A.

(1989). Passwords in use in a university timesharing environment. Computers and Security, 8, 569–579.

Schultz

E. E.

(in press). Web security and privacy. In Proctor

R. W.

Proctor

K.-P. L.

(Eds.) Handbook of human factors in Web design. Mahwah, NJ: Erlbaum.

10.

Slamecka

N. J.

Graf

(1978). The generation effect: Delineation of a phenomenon. Journal of Experimental Psychology: Human Learning and Memory, 4, 592–604.

11.

K.-P. L.

Bhargav

Proctor

R. W.

(2003). Imposing password restrictions for multiple accounts: Impact on generation and recall of passwords. Proceedings of the 47th annual meeting of the Human Factors and Ergonomics Society (pp. 1331–1335). Santa Monica, CA: HFES.