SaTC: CORE: Small: Identifying and Quantifying Design Principles For Improving Password Manager Usage

为了安全起见，人们需要选择攻击者无法猜到的强密码。他们还需要为每个帐户设置不同的密码。这项任务的难度导致很多人选择弱密码或重复使用密码。密码管理器通过帮助人们创建、存储和输入密码来提高密码质量，从而允许创建更强且唯一的密码。然而，先前的研究表明，尽管人们喜欢他们的密码管理器，但他们无法使用密码管理器的许多安全关键功能。例如，许多人只存储自己创建的密码，而忽略了密码管理器的密码生成功能，从而使自己容易受到攻击。该项目将通过衡量不同设计可以在多大程度上鼓励人们使用密码管理器提供的所有安全关键功能来解决这个问题。这项工作不仅将增加对如何构建密码管理器和其他身份验证系统的科学理解，还将为密码管理器用户提供实实在在的安全和可用性好处。这些安全和可用性的好处将对社会福利和国防产生积极影响。该项目将致力于确定设计原则，以在三个方面提高密码管理器的可用性、实用性和利用率。首先，该项目将解决密码生成问题，使在各种设备上输入生成的密码变得更容易，例如平板电脑、电视、游戏机等。这将通过调查人们输入密码的设备、测量这些设备的输入特征并设计考虑这些特征的密码生成方案来实现。对这些原型进行的用户研究将衡量它们的相对有效性。其次，该项目将改进密码管理员的健康检查功能。为此，将进行探索性用户研究，以了解正确和频繁使用密码健康检查的障碍，建立解决这些障碍的原型系统，然后衡量这些原型在用户研究中的有效性。第三，该项目将探索密码管理器如何更好地支持父母和孩子的共生需求。为此，将通过访谈和调查父母和儿童，以了解他们的认证需求和他们目前如何使用密码管理器，设计满足这些需求的方法和建立原型，并通过用户研究评估这些原型。在整个研究过程中确定的设计原则将在研究论文中和一个面向公众的网站上进行总结，该网站以密码管理器供应商和其他研究人员易于理解的方式综合了该项目的结果。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

To be safe, people need to select strong passwords that attackers can’t guess. They also need a different password for every one of their accounts. The difficulty of this task leads many people to select weak passwords or reuse passwords. Password managers seek to improve password quality by helping people create, store, and enter passwords, allowing for the creation of stronger and unique passwords. However, prior research has shown that while people like their password managers, they fail to use many of the password manager’s security-critical functionality. For example, many people only store passwords of their own creation, ignoring the password manager’s password generation feature, leaving themselves vulnerable to attack. This project will address this problem by measuring the extent to which different designs can encourage people to use all the security-critical functionality their password manager provides. Not only will this work increase the scientific understanding of how to build password managers and other authentication systems, but it will also offer tangible security and usability benefits to password manager users. These security and usability benefits will positively impact societal welfare and national defense.This project will work to identify design principles to improve password managers’ usability, utility, and utilization in three areas. First, this project will address password generation, making it easier to enter generated passwords on a wide range of devices—for example, tablets, TVs, game consoles, etc. This will be accomplished by surveying people regarding the devices where they enter passwords, measuring those devices’ input characteristics, and designing password generation schemes that consider those characteristics. User studies comparing these prototypes will measure their relative effectiveness. Second, this project will improve password managers’ health check functionality. This will be done by conducting exploratory user studies to understand impediments to using password health checks correctly and frequently, prototyping systems that address those impediments, then measuring the effectiveness of those prototypes in user studies. Third, this project will explore how password managers can better support the symbiotic needs of parents and children. This will be done by interviewing and surveying parents and children to understand their authentication needs and how they currently use password managers, designing and prototyping approaches for addressing those needs, and evaluating those prototypes through user studies. Design principles identified throughout this research will be summarized in research papers and on a public-facing website that synthesizes this project’s results in a manner easily digested by password manager vendors and other researchers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.