Personal choice and challenge questions
Personal choice and challenge questions
复制标题
个人选择和挑战问题
DOI：
10.1145/1572532.1572543
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
Just M
中科院分区：
文献类型：
--
作者：
Just M
质询问题是主流身份验证解决方案中越来越重要的一部分，但很少有关于其可用性或安全性的已发表研究。本文报道了一项关于被动选择问题的实验研究。我们从一大批学生中收集问题，鼓励参与者提供真实的数据。这些问题使我们能够考虑可能的攻击模式，并根据攻击者知识的创新模型来判断破解问题所需的相对努力。使用这个模型，我们发现许多参与者可能选择了熵值低的问题，但他们相信他们的挑战问题可以抵抗陌生人的攻击。虽然通过提出多个问题，我们能够为大多数用户展示安全性的显着改善。在我们实验的第二阶段，我们应用现有的指标来衡量问题和答案的可用性。尽管有年轻的记忆和选择自己的问题，用户犯错误的频率比理想的。
Challenge questions are an increasingly important part of mainstream authentication solutions, yet there are few published studies concerning their usability or security. This paper reports on an experimental investigation intouser-chosenquestions. We collected questions from a large cohort of students, in a way that encouraged participants to give realistic data. The questions allow us to consider possible modes of attack and to judge the relative effort needed to crack a question, according to an innovative model of the knowledge of the attacker. Using this model, we found that many participants were likely to have chosen questions with low entropy answers, yet they believed that their challenge questions would resist attacks from a stranger. Though by asking multiple questions, we are able to show a marked improvement in security for most users. In a second stage of our experiment, we applied existing metrics to measure the usability of the questions and answers. Despite having youthful memories and choosing their own questions, users made errors more frequently than desirable.