Constructing secure and memorable passwords. (23rd June 2020)

• Record Type: Journal Article
• Authors: Kävrestad, Joakim; Lennartsson, Markus; Birath, Marcus; Nohlberg, Marcus
• Is Part Of: Information and computer security. Volume 28:Number 5(2020)
• Page Start: 701
• Page End: 717
• Publication Date: 2020-06-23
• Subjects: Passwords -- Security -- Usability -- Computer users -- Memorability -- Strategies -- Computer security; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-07-2019-0077
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: Using authentication to secure data and accounts has grown to be a natural part of computing. Even if several authentication methods are in existence, using passwords remain the most common type of authentication. As long and complex passwords are encouraged by research studies and practitioners alike, computer users design passwords using strategies that enable them to remember their passwords. This paper aims to find strategies that allow for the generation of passwords that are both memorable and computationally secure. Design/methodology/approach: The study began with a literature review that was used to identify cognitive password creation strategies that facilitate the creation of passwords that are easy to remember. Using an action-based approach, attack models were created for the resulting creation strategies. The attack models were then used to calculate the entropy for passwords created with different strategies and related to a theoretical cracking time. Findings: The result of this study suggests that using phrases with four or more words as passwords will generate passwords that are easy to remember and hard to attack. Originality/value: This paper considers passwords from a socio-technical approach and provides insight into how passwords that are easy to remember and hard to crack can be generated. The results can be directly used to create password guidelines and training material that enables users to create usable and secure passwords.