We develop an economic model of an offline password cracker which allows us to make
quantitative predictions about the fraction of accounts that a rational password attacker …

Challenging the conventional wisdom that users cannot remember cryptographically-strong
secrets, we test the hypothesis that users can learn randomly-assigned 56-bit codes …

Time-based one-time password (TOTP) systems in use today require storing secrets on both
the client and the server. As a result, an attack on the server can expose all second factors …

Mnemonic strategy has been recommended to help users generate secure and memorable
passwords. We evaluated the security of 6 mnemonic strategy variants in a series of online …

We report on a user study that provides evidence that spaced repetition and a specific
mnemonic technique enable users to successfully recall multiple strong passwords over …

6, 249, 868 B16/2001 Sherman et al. 6, 411, 283 B1 6/2002 Murphy 6, 658, 328 B1 12/2003
Alrabady et al. 6, 934, 860 B1 8/2005 Goldstein 6, 983, 065 B1 1/2006 Akgul et al. 7, 243 …

An adversary who has obtained the cryptographic hash of a user's password can mount an
offline attack to crack the password by comparing this hash value with the cryptographic …

Fallback authentication is used to retrieve forgotten passwords. Security questions are one
of the main techniques used to conduct fallback authentication. In this paper, we propose a …

Security questions are one of the techniques used in fall-back authentication to retrieve
forgotten passwords. This paper proposes a game design which aims to improve usability of …

What can a human compute in his/her head that a powerful adversary cannot infer? To
answer this question, we define a model of human computation and a measure of security …