SaTC: CORE: Improving Password Ecosystem: A Holistic Approach

用户身份验证是大多数需要某种安全级别的信息系统的重要组成部分。由于其易于使用，广泛部署和用户熟悉度，密码在过去一直是最广泛采用的用户身份验证机制，并且在可预见的未来可能继续成为网络安全的重要组成部分。同时，众所周知，密码的安全性和可用性之间存在紧张关系。通常情况下，安全的密码很难记住，使它们不太可用，而令人难忘的密码往往是可预测和可重复的。该项目旨在改善复杂的密码生态系统，包括帮助人类用户和需要密码的网站的方法。 其中一个研究重点是开发帮助人类用户的技术，特别是有效培训人类创建和记住安全密码的技能的方法。 另一个研究重点是研究如何改进网站的密码生成界面，它对用户的密码生成性能起着决定性的作用。为了帮助人类用户，该项目旨在开发和评估心理密码生成策略-可以由人类执行的认知算法-用于生成可以由人类用户获取和实现的高熵密码。有效的生成策略应该易于使用，生成的密码应该不可预测且易于回忆。用户面临的另一个主要挑战是需要密码的大量帐户。研究人员正在研究有效的心理密码管理系统，其中不同帐户的密码以分层方式组织，并与网站域名相关，以便更容易回忆，而拥有此类密码的攻击者仍然很难轻易猜测另一个密码。为了帮助网站促进以用户为中心的安全密码生成，本项目研究如何通过开发有效的密码强度通信和嵌入式训练方法来改进网站的密码生成界面。 该项目提出了一个研究问题，即网站应该如何检查弱密码，并有效地警告或禁止其使用，而不会对用户施加过多的努力。

User authentication is an important part of most information systems that require some level of security. Due to their ease of use, wide deployment, and user familiarity, passwords have been the most widely adopted user authentication mechanism in the past and are likely to continue to be an important part of cybersecurity for the foreseeable future. At the same time, it is well known that there is a tension between the security and usability of passwords. Often times, secure passwords are difficult to memorize, making them less usable, whereas passwords that are memorable tend to be predictable and discoverable. This project aims to improve the complex password ecosystem, including ways to help both human users and websites that require passwords. One research thrust focuses on developing techniques to help human users, and in particular, ways that effectively train humans in the skills to create and remember secure passwords. Another research thrust focuses on studying how to improve the password-generation interface of the website, which plays a decisive role in users' performance of password generation. To help human users, the project aims to develop and evaluate mental password generation strategies--cognitive algorithms that can be executed by humans--for generating high-entropy passwords that can be acquired and implemented by human users. An effective generation strategy should be easy to use, and the resulting passwords should be both unpredictable and easy to recall. Another major challenge a user faces is the large number of accounts that need passwords. The researchers are studying effective mental password management systems, in which passwords for different accounts are organized in a hierarchical manner and related to the website domain name to make recall easier, while it remains difficult for an attacker who possesses such a password to easily guess another. To help websites promote user-centered and safe password generation, this project studies how to improve the password-generation interface of the website by developing effective password strength communication and embedded training methods. The project poses the research question of how should websites check for weak passwords and effectively warn against or forbid their use, without imposing excess effort on the user.