Improving security and usability of passphrases with guided word choice

Nicolas Blanchard (1) , Clément Malaingre (2) , Ted Selker (3)

1 IRIF (UMR_8243) - Institut de Recherche en Informatique Fondamentale
2 Teads France
3 Selker Design Research

Passphrases have many uses, such as serving as seeds for passwords. User-created passphrases are easier to remember, but tend to be less secure than ones created from words randomly chosen in a dictionary. This paper develops a way of making more memorable, more secure passphrases. It investigates the security and usability of creating a passphrase by choosing from a randomly generated set of words presented as a two-dimensional array. A usability experiment shows that participants using this method achieved 97% to 99% of the maximal theoretical entropy and commited fewer than half as many memory mistakes as a control group with assigned passphrases. It also shows that their choices are affected by word familiarity and weakly by the word’s position in the array. Prompting a person with random words from a large dictionary is an effective way of helping them make a more memorable high-entropy passphrase.

Mots clés: Passwords; Usable security; Mnemonic phrases

Domaines: Interface homme-machine [cs.HC]

Nicolas Blanchard, Clément Malaingre, Ted Selker. Improving security and usability of passphrases with guided word choice. Annual Computer Security Applications Conference (ACSAC), Dec 2018, San Juan, Puerto Rico. ⟨10.1145/3274694.3274734⟩. ⟨hal-01781233⟩