An empirical study of mnemonic password creation tips. Issue 85 (August 2019)

• Record Type: Journal Article
• Authors: Ye, Bei; Guo, Yajun; Zhang, Lei; Guo, Xiaowei
• Is Part Of: Computers & security. Issue 85(2019)
• Page Start: 41
• Page End: 50
• Publication Date: 2019-08
• Subjects: Password tip -- Mnemonic password -- Password strength -- Password policy -- Guessability; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.04.009
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Usually, strong passwords tend to be hard to memorize, and easy-to-remember passwords tend to be predictable. User-created passwords are memorable but may be easily cracked. Is there any strategy that can help users choose a strong but still memorable password? Some users have already used mnemonic tips to create passwords, are the passwords created by these tips strong passwords? In this paper, we studied the security and usability of four common mnemonic password creation tips. We recruited 209 participants in an online study, and compared the strength of passwords created by the 4 tips with two commonly used datasets 178 website and phpBB website against guessing attacks. We utilized PCFG and Markov Model to analyze the guessability of passwords created by the 4 tips and the two control groups. We also used the approach of the statistical quantities to measure the distributions of the passwords for each group, for example, we chose to use minimum entropy, β -success-rate and α -guesswork. In addition, we also analyzed the security of these four password creation tips under known attacks. To evaluate the usability of these tips, we conducted user study in the lab. We found some expected and unexpected results, these include: Under an unknown attack, the strength of passwords created by the 4 tips is stronger than those in the two control groups. Passwords created by mnemonic tips are not necessarily strong passwords, some mnemonic tips are more convenient to create strong passwords, while others are the opposite. Under known attacks, some mnemonic tips are not resistant to offline guessing attacks. Usability results shown that these mnemonic tips exhibit inconsistent memorability.