"Your Eyes Tell You Have Used This Password Before": Identifying Password Reuse from Gaze and Keystroke Dynamics
"Your Eyes Tell You Have Used This Password Before": Identifying Password Reuse from Gaze and Keystroke Dynamics
复制标题
“你的眼睛告诉你以前用过这个密码”：从注视和击键动态识别密码重用
DOI：
10.1145/3491102.3517531
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Abdrabou Y
中科院分区：
文献类型：
--
作者：
Abdrabou Y
文本密码用于最终用户身份验证的一个重要缺点是密码重用。我们提出了一种利用注视和输入行为来检测密码重用的新方法，并研究了其准确性。我们收集了49个用户的目光和打字行为，他们分别为一个网络邮件客户端和一个新闻网站创建了账户。虽然大多数参与者都使用了新密码，但32%的人表示在设置账户时使用了旧密码。然后，我们比较了不同的ML模型，以从收集的数据中检测密码重用。我们的模型在从凝视检测密码重用方面的准确率高达87.7%，从打字检测密码重用的准确率为75.8%，在考虑两种行为时的准确率为88.75%。我们演示了使用gaze，在用户输入密码之前，在注册过程中就可以检测到密码重用。我们的工作为开发防止密码重用的新干预措施铺平了道路。
A significant drawback of text passwords for end-user authentication is password reuse. We propose a novel approach to detect password reuse by leveraging gaze as well as typing behavior and study its accuracy. We collected gaze and typing behavior from 49 users while creating accounts for 1) a webmail client and 2) a news website. While most participants came up with a new password, 32% reported having reused an old password when setting up their accounts. We then compared different ML models to detect password reuse from the collected data. Our models achieve an accuracy of up to 87.7% in detecting password reuse from gaze, 75.8% accuracy from typing, and 88.75% when considering both types of behavior. We demonstrate that using gaze, password reuse can already be detected during the registration process, before users entered their password. Our work paves the road for developing novel interventions to prevent password reuse.