Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords
Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords
复制标题
DOI：
10.14722/ndss.2015.23094
复制
发表时间：
2014-10
期刊：
影响因子：
--
通讯作者：
Jeremiah Blocki;Saranga Komanduri;L. Cranor;Anupam Datta
中科院分区：
文献类型：
--
作者：
Jeremiah Blocki;Saranga Komanduri;L. Cranor;Anupam Datta
我们报告了一项用户研究，该研究提供了证据，即间隔重复和特定的助记技术使用户能够随着时间的推移成功地回忆起多个强密码。远程研究参与者被要求记住4个人-动作-物体(PAO)故事，在这些故事中，他们从下拉列表中选择一个名人，并获得机器生成的随机动作-物体对。用户还被展示了一张场景的照片，并被要求想象鲍康如的故事发生在这个场景中(例如，比尔·盖茨-吞咽-在海滩上骑自行车)。随后，他们被要求在127天以上的时间内按照间隔重复的时间表，在相关场景-人物对的提示下回忆动作-物体对。虽然我们评估了几个间隔重复计划，但当用户最初在12小时后返回，然后以1.5美元\乘以$递增的间隔返回时，获得了最好的结果：77%的参与者在158天的10次测试中成功回忆了所有4个故事。大部分遗忘发生在第一个测试期(12小时)：在第一个测试期记住他们的故事的参与者中，89%的人在随后的每一轮都成功地记住了他们。这些发现，再加上最近关于自然排练密码方案的结果，表明可以使用4个PAO故事来为14个敏感账户创建可用的、强大的密码，遵循这种间隔的重复时间表，可能需要额外的几次预先排练。此外，我们还发现，多个PAO故事之间存在干扰效应：召回率为100%(分别为。90%)对于被要求记忆1个PAO故事的参与者(分别为2个鲍鱼故事)的回忆率显著好于被要求记忆4个鲍鱼故事的参与者。这些发现为改进密码管理方案的构建和未来的用户研究提供了具体的建议。
We report on a user study that provides evidence that spaced repetition and a specific mnemonic technique enable users to successfully recall multiple strong passwords over time. Remote research participants were asked to memorize 4 Person-Action-Object (PAO) stories where they chose a famous person from a drop-down list and were given machine-generated random action-object pairs. Users were also shown a photo of a scene and asked to imagine the PAO story taking place in the scene (e.g., Bill Gates---swallowing---bike on a beach). Subsequently, they were asked to recall the action-object pairs when prompted with the associated scene-person pairs following a spaced repetition schedule over a period of 127+ days. While we evaluated several spaced repetition schedules, the best results were obtained when users initially returned after 12 hours and then in $1.5\times$ increasing intervals: 77% of the participants successfully recalled all 4 stories in 10 tests over a period of 158 days. Much of the forgetting happened in the first test period (12 hours): 89% of participants who remembered their stories during the first test period successfully remembered them in every subsequent round. These findings, coupled with recent results on naturally rehearsing password schemes, suggest that 4 PAO stories could be used to create usable and strong passwords for 14 sensitive accounts following this spaced repetition schedule, possibly with a few extra upfront rehearsals. In addition, we find that there is an interference effect across multiple PAO stories: the recall rate of 100% (resp. 90%) for participants who were asked to memorize 1 PAO story (resp. 2 PAO stories) is significantly better than the recall rate for participants who were asked to memorize 4 PAO stories. These findings yield concrete advice for improving constructions of password management schemes and future user studies.