Security analysis of Game Changer Password System. Issue 126 (June 2019)

• Record Type: Journal Article
• Authors: Brumen, Boštjan
• Is Part Of: International journal of human-computer studies. Issue 126(2019)
• Page Start: 44
• Page End: 52
• Publication Date: 2019-06
• Subjects: Security -- Passwords -- Cryptanalysis -- Games -- Memory; Human-machine systems -- Periodicals; Systems engineering -- Periodicals; Human engineering -- Periodicals; Human engineering; Human-machine systems; Systems engineering; Periodicals; Electronic journals; 004.019
• DOI: 10.1016/j.ijhcs.2019.01.004
• Languages: English
• ISSNs: 1071-5819

Abstract

Highlights: The Game Changer Password System is analyzed for security. Monopoly and chess-based password search space is too low to resist brute force attacks. Users do not select locations and pieces uniformy, hence smart brute force or dictionary attacks can crack passwords within days. Security of game-based passwords can be improved by using games with larger boards (e.g. Go, Battleship), higher number of pieces and colors. Abstract: In the paper we present the results of security analysis of the Game Changer Password System, proposed by McLennan et al.—a mnemonic variant of password security that uses game positions as passwords. The idea is that several different games are graphically presented on the screen, allowing users to select the game first and then to enter his or her password in the game selected in the form of putting pieces on a board. For example, a user first selects chess, then puts four chess figures on the chessboard. A password is represented by the fact that chess was used and figures' locations. The first issue with the proposed system is a small search space—the number of possible combinations of passwords, enabling relatively simple and quite inexpensive brute force attacks. The second issue is that users prefer specific locations and figures over others, further reducing the search space and thus enabling attackers to speed up the attacks with high probabilities of success. Based on the issue of non-uniformity of locations and figures attackers can build special dictionaries to launch dictionary-based attacks. We elaborate on the weaknesses and propose a solution that produces stronger passwords. However, the tradeoff between memorability and attack resilience must be taken into the account.