On improving the memorability of system-assigned recognition-based passwords. Issue 5 (4th April 2022)

• Record Type: Journal Article
• Authors: Al-Ameen, Mahdi Nasrullah; Marne, Sonali T.; Fatema, Kanis; Wright, Matthew; Scielzo, Shannon
• Is Part Of: Behaviour & information technology. Volume 41:Issue 5(2022)
• Page Start: 1115
• Page End: 1131
• Publication Date: 2022-04-04
• Subjects: Usable security -- system-assigned password -- memorability -- lab study -- field study; Electronic data processing -- Periodicals; Human engineering -- Periodicals; Information technology -- Periodicals; 303.4833
• DOI: 10.1080/0144929X.2020.1858161
• Languages: English
• ISSNs: 0144-929X

Abstract

ABSTRACT: User-chosen passwords reflecting common strategies and patterns ease memorisation but offer uncertain and often weak security, while system-assigned passwords provide higher security guarantee but suffer from poor memorability. We thus examine the technique to enhance password memorability that incorporates a scientific understanding of long-term memory. In particular, we examine the efficacy of providing users with verbal cues —real-life facts corresponding to system-assigned keywords. We also explore the usability gain of including images related to the keywords along with verbal cues. In our multi-session lab study with 52 participants, textual recognition-based scheme offering verbal cues had a significantly higher login success rate (94.23%) compared to the control condition, i.e. textual recognition without verbal cues (61.54%). When users were provided with verbal cues, adding images contributed to faster recognition of the assigned keywords, and thus had an overall improvement in usability. So, we conducted a field study with 54 participants to further examine the usability of graphical recognition-based scheme offering verbal cues, which showed an average login success rate of 98% in a real-life setting and an overall improvement in login performance with more login sessions. These findings show a promising research direction to gain high memorability for system-assigned passwords.