Markus Jakobsson, Ruj Akavipat; Rethinking Passwords to Adapt to Constrained Keyboards; In Proceedings of CCS (CCS ’11); 2011; 11 pages.
We describe and analyze a variant of the traditional password scheme. This is designed to take advantage of standard error-correcting methods of the types used to facilitate text entry on handsets. We call the new approach fast- words to emphasize their primary feature compared to regular passwords. Compared with passwords, fastwords are approximately twice as fast to enter on mobile keyboards, and approximately three times as fast on full-size keyboards. This is supported by user studies reported on herein. Furthermore, these user studies show that fastwords also have considerably greater entropy than passwords, and that their recall rates are dramatically higher than that of passwords and PINs. The new structure permits a memory jogging technique in which a portion of the fastword is revealed to a user who has forgotten it. We show that this results in boosted recall rates, while maintaining a security above that of traditional passwords. We also introduce the notion of equivalence classes, whether based on semantics or pronunciation, and describe uses, including voice-based authentication. The new technology does not need any client-side modification.
Hsing Ping Fu; Pico: No More Passwords!; Masters Thesis; K. U. Leuven; 2013; 66 pages.
Managing passwords for online application accounts is a heavy responsibility for users. Using easily remembered passwords or repeatedly using the same password makes the account susceptible to brute force guessing. Furthermore, the password-protected accounts are vulnerable to attacks like phishing, keylogging, eavesdropping, and man-in-the-middle attacks, no matter how strong the passwords are. Hence the urgent need for an alternative to password system.
Stajano proposed a candidate known as Pico . This is an authentication hardware token utilizing mutual authentication with the application server to obtain access to users’ accounts. The credentials for the authentication are created and managed by Pico and are guaranteed to be secure and unique for each application. The Pico device is portable and easy to use, allowing users to login everywhere. Compared to other existing password alternatives, Pico has the advantage of providing protection against the attacks mentioned above and effortless access control device.
Although Stajano presents desirable functionalities in for the Pico, its practicality remains to be demonstrated. Toward this goal, this thesis proposes a set of specifications for the Pico device, and a prototype device to demonstrate the Pico functionalities. The specification defines authentication protocols, the underlying cryptographic algorithms, and the credentials. The protocols mutually authenticate Pico and the server, over an encrypted channel protected by mutual secret from key exchange algorithms. The servers are verified by credentials registered in Pico database, to prevent internet phishing. Moreover, out-of-band communication schemes and message structures for all the communication between Pico and servers are specified as well.
The technical specifications are implemented on a smartphone based Pico prototype. The algorithms are programmed in Java and executed on Android platform, using several Android libraries. This prototype is capable of performing cryptographic calculations, wireless communication, and providing a proper user interface. A demonstration server is also implemented to test the entire Pico system. As a result, users can log on to this server by pointing the Pico prototype to the QR code displayed on the web page, and the account can be accessed within few seconds.
Frank Stajano; Pico: No More Passwords!; In Proceedings of the Security Protocols Workshop; 2011; 34 pages; revision 61 of 2011-08-31 19:55:55 +0100
From a usability viewpoint, passwords and PINs have reached the end of their useful life. Even though they are convenient for implementers, for users they are increasingly unmanageable. The demands placed on users (passwords that are unguessable, all different, regularly changed and never written down) are no longer reasonable now that each person has to manage dozens of passwords. Yet we can’t abandon passwords until we come up with an alternative method of user authentication that is both usable and secure. We present an alternative design based on a hardware token called Pico that relieves the user from having to remember passwords and PINs. Unlike most alternatives, Pico doesn’t merely address the case of web passwords: it also applies to all the other contexts in which users must at present remember passwords, passphrases and PINs. Besides relieving the user from memorization efforts, the Pico solution scales to thousands of credentials, provides “continuous authentication” and is resistant to brute force guessing, dictionary attacks, phishing and keylogging.
Jeremiah Blocki, Manuel Blum, Anupam Datta; Naturally Rehearsing Passwords; In arXiv; 2013-09-11; 34 pages.
We introduce quantitative usability and security models to guide the design of password management schemes — systematic strategies to help users create and remember multiple passwords. In the same way that security proofs in cryptography are based on complexity-theoretic assumptions (e.g., hardness of factoring and discrete logarithm), we quantify usability by introducing usability assumptions . In particular, password management relies on assumptions about human memory, e.g., that a user who follows a particular rehearsal schedule will successfully maintain the corresponding memory. These assumptions are inform ed by research in cognitive science and can be tested empirically. Given rehearsal requirement s and a user’s visitation schedule for each account, we use the total number of extra rehearsals that the user would have to do to remember all of his passwords as a measure of the usability of the password scheme. Our usability model leads us to a key observation: password reuse benefits users not only by reducing the number of passwords that the user has to memorize, but more importantly by increasing the natural rehearsal rate for each password. We also present a security model which accounts for the complexity of password management with multiple accounts and associated threats, including online, offline, and plaintext password leak attacks. Observing that current password management schemes are either insecure or unusable, we present Shared Cues — a new scheme in which the underlying secret is strategically shared across accounts to ensure that most rehearsal requirements are satisfied naturally while simultaneously providing strong security. The construction uses the Chinese Remainder Theorem to achieve these competing goals.