The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes

By Joseph Bonneau, Cormac Herley, P. V. Oorschot, Frank Stajano. IEEE Symposium on Security and Privacy, 2012

1,063 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/9faf03c33d195aaad8865bd2a781266ac8aab4f6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound (2018, methodology): “2605087) and some of our earlier attacking results [21], [46], [47], and further using the iteration methodology [1] for criterion refinement, we put forward a broad list of 12 independent criteria in terms of user friendliness and security that a two-factor scheme shall satisfy:”
The Tangled Web of Password Reuse (2014, background): “To prevent users from selecting passwords that are too simple (and therefore potentially common), designers of password authentication mechanisms often impose a password composition policy , comprising a set of rules that constrain the length and formation of passwords.”
Guessing human-chosen secrets (2012, methodology): “In surveying replacement proposals we find little evidence for any scheme replacing text passwords in the near future, a conclusion reached by several surveys of replacement schemes [227, 249, 45] and essays by senior researchers in the field [114, 143, 142].”
Face Recognition on Consumer Devices: Reflections on Replay Attacks (2015, background): “The requirement that security systems be usable if they are to succeed has been highlighted in several studies [24]–[28].”
Privacy and Data Protection by Design - from policy to engineering (2014, background): “A weaker form of privacy-friendly authentication is common for web-services, and is based on a username and password being disclosed to a service though an encrypted connection [37] (e.”
A Security Analysis of Honeywords (2018, neutral): “Passwords firmly remain the most prevalent method for user authentication and are likely to keep their place in the foreseeable future, despite their notorious defects in both security and usability [3], [6], [28].”