How Does Your Password Measure Up

8/13/2019 How Does Your Password Measure Up

http://slidepdf.com/reader/full/how-does-your-password-measure-up 1/69

Blase Ur, Patrick Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass,Michelle L. Mazurek, Timothy Passaro, Richard Shay, Timothy Vidas,Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor

How does your password measure up?

The effect of strength meters onpassword creation

Password Meters

Feedback of password strength at creation timeEncourage users to create “stronger” passwords

PayPal

Password Meters

Widely usedGoogle

WordPress

USENIX

Password Meters

Come in all shapes and sizes

Primary Research Questions

1. How do password meters affect …? CompositionGuessabilityCreation processMemorabilityUser sentiment

2. What elements of meter design are important?We present the first large-scale experiment onhow the visual and scoring aspects of meters

affect password properties

Methodology

2,931-participant online study• Between-subjects design

15 conditions: no meter + 14 different meters

• 2-part study, 2+ days apartCompensated $0.55 and $0.70, respectively

Methodology

Part 1: Create a password and answer a surveyabout its creationScenario: Main email provider is requiring you tochange your password

Only requirement: 8+ characters

• Part 2: Emailed to return, re-enter password, andanswer a survey about remembering password

Overview of Conditions

• Control conditions

• Visual differences

• Scoring differences

• Both visual & scoring differences

Control Conditions

• Conditions to which all others were compared:

No meter: No feedback on strength

Baseline meter : Standard password meter

Baseline Password Meter

• Based on meters used “in the wild” 8 lowercase letters would fill 1/3 rd of the meter

• Higher scores possible from:

Longer passwords, e.g., passwordpasswordMore character classes, e.g., Pa$5worD

Non-segmented bar

Bad Poor Fair Good Excellent

Provides a suggestion

Checks against OpenWall cracking dictionary

Changes color: red orange/yellow green

Overview of Conditions

• Control conditions (2)

• Visual differences (7)

• Scoring differences (4)

• Both visual & scoring differences (2)

Conditions with Visual Differences

Bunny Condition

Conditions with Scoring Differences

Conditions with Visual & Scoring Diff.

Stringent Meters

• Those with more stringent scoring:Half-scoreOne-third-scoreText-only-halfBold text-only-half

Participants

• 2,931 participantsRecruited on Amazon’s Mechanical Turk

• 63% male, 37% female

• 40% technical (degree/job)

• 18 to 74 years old

• 96 countries42% from India32% from U.S.

M i f R l

Metrics for Results

• Composition

• Guessability

Creation process• Memorability

Sentiment

M i P d C i i

Metric – Password Composition

• Password length

P d L h

Password Length

P d L h

Password Length

Meters lead to

longer passwords

M i G bili

Metric – Guessability

• Guessability – how many guesses to crack?Threat model: offline attack

• Brute-force first guesses: aaaaaaaa, aaaaaaab• Better first guesses: 12345678, password

Cracking algorithm: Weir et al. (Oakland ‘09)

Guess calculator: Kelley et al. (Oakland ‘12)

Weak adversary: 500 million guesses (5×10 8)Medium adversary: 50 billion guesses (5×10 10)Strong adversary: 5 trillion guesses (5×10 12)

R lt G bilit (N t )

Results – Guessability (No meter)

Number of Guesses

P e r c e n t a g e o

f P a s s w

o r d s C r a c k e

10 4 10 5 10 6 107 10 8 109 1010 10 11 1012 10 13

No meter

Weak5×10 8

Medium5×10 10

Strong5×10 12

Better

R lt G bilit (C t l )

Results – Guessability (Controls)

Number of Guesses

f P a s s w

o r d s C r a c k e

10 4 10 5 10 6 107 10 8 109 1010 10 11 1012 10 13

No meterBaseline meter

Weak5×10 8

Medium5×10 10

Strong5×10 12

R lt G bilit (Vi l)

Results – Guessability (Visual)

Number of Guesses

f P a s s w

o r d s C r a c k e

10 4 10 5 10 6 107 10 8 109 1010 10 11 1012 10 13

Text-onlyGreenTiny

HugeBunnyNo suggestionsThree-segment

Weak5×10 8

Medium5×10 10

Strong5×10 12

R lt G bilit (Vi l)

Results – Guessability (Visual)

Number of Guesses

f P a s s w

o r d s C r a c k e

10 4 10 5 10 6 107 10 8 109 1010 10 11 1012 10 13

Text-onlyGreenTiny

HugeBunnyNo suggestionsThree-segment

Weak5×10 8

Medium5×10 10

Strong5×10 12

Visual changes don’t

significantly increaseresistance to guessing

R lt G bilit (S i g)

Results – Guessability (Scoring)

Number of Guesses

f P a s s w

o r d s C r a c k e

10 4 10 5 10 6 107 10 8 109 1010 10 11 1012 10 13

Nudge-comp8Bold text-only

Text-only halfNudge-16One-third-scoreHalf-score

Weak5×10 8

Medium5×10 10

Strong5×10 12

Results Guessability (Significant)

Results – Guessability (Significant)

Number of Guesses

f P a s s w

o r d s C r a c k e

10 4 10 5 10 6 107 10 8 109 1010 10 11 1012 10 13

No meter

One-third-scoreHalf-score

Weak5×10 8

Medium5×10 10

Strong5×10 12

Results Guessability (Significant)

Results – Guessability (Significant)

Number of Guesses

f P a s s w

o r d s C r a c k e

10 4 10 5 10 6 107 10 8 109 1010 10 11 1012 10 13

No meter

One-third-scoreHalf-score

Weak5×10 8

Medium5×10 10

Strong5×10 12

Stringent meters with

visual bars increaseresistance to guessing

Creation Process

• Time to create password

• Changed their mind during creation

Results Password Time of Creation

Results – Password Time of Creation

T i m e o

f c r e a t i o n

T i m e o

f c r e a t i o n

T i m e o

f c r e a t i o n

More time was spent

creating a passwordwith stringent meters

Results Changed Their Mind

Results – Changed Their Mind

• Changed their mind during password creationTyped 8+ character password

Completely erased it

Saved a different password

usenixsec

iLIKEbunnies

h o c h a n g e

d m i n

h o c h a n g e

d m i n d

h o c h a n g e

d m i n d

Meters lead people to

change their mind duringpassword creation

Metric Memorability

Metric – Memorability

• Successful login about 5 minutes later and2+ days later

• Return rate

• Wrote password down, stored it, or pasted it

• No significant differences across conditionsfor any of these metrics

Metric – Sentiment

• Level of agreement with 14 statementsPassword creation (e.g., fun, difficult, annoying)Password meter (e.g., incorrect, high score important)

Results – Sentiment

• Stringent meters a bit more annoying

• Stringent meters violated expectations

The Password Strength Meter Was Annoying

nudge-comp8

baseline meter

three-segmentgreen

tinyhuge

no suggestions

text-onlybunny

half-scoreone-third-score

nudge-16

text-only half-scorebold text-only half-score

Visual

Scoring

Visual &Scoring

Control

three-segmentgreen

nudge-comp8

40%34%

tinyhuge

no suggestions

text-onlybunny

half-scoreone-third-score

nudge-16

text-only half-scorebold text-only half-score

Visual

Scoring

Visual &Scoring

Control baseline meter

Takeaway: Meters Matter

• Meters lead to longer passwords

• Stringent meters reduce guessability

• Meters don’t affect memorability

• Overly stringent meters don’t add benefits May even backfire

Takeaway: What Makes Meters Matter

• Important featuresScoring stringencyHaving a visual component

• Less important featuresColorSegmentation

SizeBunnyness

• Important featuresScoring stringencyHaving a visual component

• Less important featuresColorSegmentation

SizeBunnyness

Blase Ur (bur@cmu.edu),Patrick Gage Kelley, Saranga Komanduri,

Joel Lee, Michael Maass,Michelle L. Mazurek, Timothy Passaro,

Richard Shay, Timothy Vidas, Lujo Bauer,Nicolas Christin, Lorrie Faith Cranor

ThankYou!

How Does Your Password Measure Up

Documents

Transcript of How Does Your Password Measure Up

How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation · How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation Blase

1) What does this tool measure?. 2) What does this tool measure?

Warm up What does APD measure?What does APD measure? What does PPD measure?What does PPD measure? Remember to have your headphones and cell phones put.

Healthcare in Focus 2013 - How does NSW measure up?

Does Your Social Media Measure Up - Yenni Vance

How Does the Hawaii High School Assessment Measure Up?

Suziedelyte Does SAH measure health

The Federal Deficit: Does It Measure the Government's ...The Federal Deficit: Does It Measure the Government's Effect on National Saving? MARCH 1990 ... Does it Measure the Government's

How does health psychology measure up

Tobin’s q Does Not Measure Firm Performance: Theory ...ffffffff-c5d3-4994-ffff-ffffd8f... · Tobin’s q Does Not Measure Firm Performance: Theory, Empirics, and Alternatives Philip

HOW DOES YOUR SOCIAL MEDIA MEASURE UP?. Why Social?

How Does Your Password Measure Up? The Effect …lbauer/papers/2012/usenix2012...How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation Blase Ur, Patrick

Small Business Activity Does not Measure · PDF fileSmall Business Activity Does not Measure ... Small Business Activity Does not Measure Entrepreneurship . ... the self-employment

Web viewWhat are the best arguments pro and con for Measure 97? How does Measure 97 reflect the strongly held views of various interest groups? How does Measure 97 reflect the use

[Infographic] How Does Your Incentive Travel Program Measure Up?

Pinstripe Presents: Corporate Recruiting - How Does Your Organization Measure Up?

Best Practice Onboarding: How Does Twitter Measure Up?

How Does Your Model Measure Up

1Static99-R What Does It Measure Out

How should we measure habit? (And does it matter?)