Password memorability and security: empirical results

By Jeff Yan, A. Blackwell, Ross J. Anderson, Alasdair Grant. IEEE Security & Privacy Magazine, 2004

723 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/28e38031b39ca6f31649feec560b005983a5a047

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Password Cracking Using Probabilistic Context-Free Grammars (2009, background): “While user education efforts can improve the chances that users will choose safer and more memorable passwords [2], systems that allow users to choose their own passwords are typically vulnerable to space-reduction attacks that can break passwords considerably more easily than through a brute-force…”
A Research Agenda Acknowledging the Persistence of Passwords (2012, neutral): “strong passwords [14].”
Testing metrics for password creation policies by attacking large sets of revealed passwords (2010, background): “In [21], Yan, Blackwell, and Anderson found when testing a group of 300 student passwords, 32% of the control group was cracked via a limited dictionary based attack.”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, background): “Worse, some studies report the running time of cracking software instead of dictionary size [14], [24], [25], making comparison difficult.”
Graphical passwords: Learning from the first twelve years (2012, background): “However, text passwords also suffer from both security and usability disadvantages for example, passwords are typically dif.cult to remember and are predictable if user choice is allowed [Morris and Thompson 1979; Klein 1990; Sasse et al. 2001; Yan et al. 2004; Bentley and Mallows 2005].”
The true cost of unusable password policies: password use in the wild (2010, background): “Since then, we have seen studies of passwords using controlled [22] and survey methodologies [10, 23], which provide some understanding of the policy factors that make passwords easier to generate, remember, and use, in ways which are appropriate to the situation.”
Zipf’s Law in Passwords (2017, neutral): “Truly random passwords are difficult for users to memorize, while user-generated passwords may be highly predictable [1], [2].”
A large-scale study of web password habits (2007, background): “[9] performed a more recent study of password memorability and security.”
A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords (2006, background): “Although organizations may adopt “strong” password policies [11] that encourage or require users to select passwords less susceptible to discovery, such policies typically increase the burden on the users’ ability to remember those passwords [46].”
Guessing human-chosen secrets (2012, background): “Worse, some studies report the running time of cracking software instead of dictionary size [63, 322, 284], making comparison difficult.”
What's in a Name? (2020, background): “Passwords and PINs are the most well-known, but there exist a variety of graphical and textual schemes to aid in recalling secret data [31,29,22,6].”