Improving Password Usability with Visual Techniques
Saranga Komanduri · OhioLink ETD Center (Ohio Library and Information Network) · 2008
Current technology is more than capable of providing a secure authentication process, but users are limited in their ability to remember difficult passwords and make judgments about security.In this thesis, both of these problems were addressed in the development of a new picture-password system.Studies in computer security, password usability, and cognitive psychology were referenced throughout the design process.The new system was tested against character passwords of equal complexity and recall was measured over an eight-day period.The results of the study show that a picture password system which accepts input without respect to order can be both secure and memorable.Both character and picture passwords were randomly assigned from a password space of almost 29 billion possible passwords.The picture passwords were remembered by all fifteen of the picture-group participants eight days later, whereas character passwords were not universally remembered.In addition, I found that a substantial number of failed inputs by users are repeats of previous inputs in the same session.This reduces the number of distinct guesses users can make when authentication systems limit the number of allowed failed logins (known as account lockout).A protocol was developed to ignore these duplicate inputs in a way which incurs almost no security risk and improves usability.iii ACKNOWLEDGEMENTS It was Dr. Lancaster who first suggested that I persue the thesis option when I began to consider Ph.D. programs.I am certain that this thesis would never have happened without his advice.Months later, I approached Dr. Kresman with a very rough idea for a picture password system after having done a small amount of research.Meetings with Dr.Hutchings and Dr. Leventhal soon followed and everyone was very supportive and full of ideas on how to proceed.So much so, that I was unsure of where to concentrate my efforts.I decided to discuss the matter with Dr. Dunning, who helped me to narrow my scope and decide on a broad structure.Throughout the process, feedback from my committee was invaluable.Frequent meetings with Dr. Hutchings helped me to understand research, experiments, and academic writing in general, and his comments always led to improvements in the finished product.Dr. Leventhal introduced me to related work in the psychology literature and also helped me with materials for running experiments in the CHIL (Computer-Human Interaction Lab).Dr. Kresman helped me with security topics and in improving the material in Chapter 5. Everyone in my committee pushed me to improve the structure of this manuscript from a simple documentation of work to a (hopefully) more cohesive product.Though I struggled to meet deadlines, and often failed to do so, the final product is better for it.I would also like to thank Dr. Klopfer.Though not a member of my committee, he passed along several relevant papers that piqued my interest in psychology.My family and friends participated in pilot testing the experiment and supported me throughout.I'd especially like to thank Jason, Casey, and Colin who seemed genuinely interested in my research even though it often left me with very little free time.They have always supported me without reservation.Finally, I'd like to thank Josh and the rest of the staff of the Technology Support iv Center for allowing me time off when I really needed it.They haven't known me for very long but they've been extremely flexible and forgiving of my schedule these last two weeks.