User Perceptions of Five-Word Passwords
User Perceptions of Five-Word Passwords
复制标题
DOI：
10.1145/3564625.3567981
复制
发表时间：
2022-12
期刊：
影响因子：
--
通讯作者：
Xiaoyuan Wu;Collins W. Munyendo;Eddie Cosic;Genevieve A. Flynn;Olivia Legault;Adam J. Aviv
中科院分区：
文献类型：
--
作者：
Xiaoyuan Wu;Collins W. Munyendo;Eddie Cosic;Genevieve A. Flynn;Olivia Legault;Adam J. Aviv
人工选择的密码通常很短，选择不统一，因此容易受到自动猜测攻击。为了帮助用户选择更安全但更容易记住的密码，专家建议使用多个单词或短语的密码短语。在本文中，我们探索了一种密码短语选择策略，即所谓的五字密码，即为用户分配五个随机单词作为密码短语。乔治城大学最近于2020年12月采用了这样的密码合成政策。通过一个由两部分组成的在线调查(n=150和n=116)，参与者在不同的条件下选择了一个五个字的密码。我们发现，计算机生成的五字密码比用户自己选择的五字密码更多样化，也可能更安全。虽然所有五字密码的情况都可能比人工生成的传统密码更安全，但参与者对五字密码(以及一般密码)的安全性表示了误解。五个字的密码似乎也会对可用性产生负面影响，只有39.7%的参与者在两周后成功回忆起了他们的密码。虽然五字密码提高了安全性，但需要更多的扩展来解释其安全优势并减少可用性负担。
Human-chosen passwords are often short, selected non-uniformly, and thus, susceptible to automated guessing attacks. To help users to select more secure but memorable passwords, experts have recommended the use of passphrases of multiple words or phrases. In this paper, we explore a strategy for passphrase selection, so-called five-word passwords, where users are assigned five random words for a passphrase. Such a password composition policy was recently adopted at Georgetown University in December 2020. Through a two-part online survey (n = 150 and n = 116), participants selected a five-word password under different conditions. We find that computer-generated five-word passwords are more diverse and likely more secure than five-word passwords users select themselves. While all cases of five-word passwords are likely more secure than a human-generated, traditional password, participants expressed misconceptions regarding the security of five-word passwords (and passwords generally). Five-word passwords also appear to negatively impact usability, only 39.7 % of participants successfully recalled their password after two weeks. While five-word passwords offer improvements for security, more outreach is needed to explain their security benefits and reduce usability burdens.