2017/12/11 by Samira Samadi, Santosh Vempala, Samadi, Samira +3
Computer Science · Decision Sciences · #Computers and Society (cs.CY) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Human-Computer Interaction (cs.HC) #Interactive and Immersive Displays #Personal Information Management and User Behavior #User Authentication and Security Systems
paper · pdf · doi:10.48550/arxiv.1712.03650
openalex publication_date 2017/12/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/01
Reusing passwords across multiple websites is a common practice that compromises security. Recently, Blum and Vempala have proposed password strategies to help people calculate, in their heads, passwords for different sites without dependence on third-party tools or external devices. Thus far, the security and efficiency of these "mental algorithms" has been analyzed only theoretically. But are such methods usable? We present the first usability study of humanly computable password strategies, involving a learning phase (to learn a password strategy), then a rehearsal phase (to login to a few websites), and multiple follow-up tests. In our user study, with training, participants were able to calculate a deterministic eight-character password for an arbitrary new website in under 20 seconds.