Entry vanOorschot:2008:PMU from tissec.bib

Last update: Sun Oct 15 02:58:48 MDT 2017                Valid HTML 3.2!

Index sections

Top | Symbols | Numbers | Math | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

BibTeX entry

@Article{vanOorschot:2008:PMU,
  author =       "P. C. van Oorschot and Julie Thorpe",
  title =        "On predictive models and user-drawn graphical
                 passwords",
  journal =      j-TISSEC,
  volume =       "10",
  number =       "4",
  pages =        "5:1--5:??",
  month =        jan,
  year =         "2008",
  CODEN =        "ATISBQ",
  DOI =          "https://doi.org/10.1145/1284680.1284685",
  ISSN =         "1094-9224 (print), 1557-7406 (electronic)",
  ISSN-L =       "1094-9224",
  bibdate =      "Thu Jun 12 17:52:24 MDT 2008",
  bibsource =    "http://portal.acm.org/;
                 http://www.math.utah.edu/pub/tex/bib/tissec.bib",
  abstract =     "In commonplace text-based password schemes, users
                 typically choose passwords that are easy to recall,
                 exhibit patterns, and are thus vulnerable to
                 brute-force dictionary attacks. This leads us to ask
                 whether other types of passwords (e. g. , graphical)
                 are also vulnerable to dictionary attack because of
                 users tending to choose memorable passwords. We suggest
                 a method to predict and model a number of such classes
                 for systems where passwords are created solely from a
                 user's memory. We hypothesize that these classes define
                 weak password subspaces suitable for an attack
                 dictionary. For user-drawn graphical passwords, we
                 apply this method with cognitive studies on visual
                 recall. These cognitive studies motivate us to define a
                 set of password complexity factors (e. g. , reflective
                 symmetry and stroke count), which define a set of
                 classes. To better understand the size of these classes
                 and, thus, how weak the password subspaces they define
                 might be, we use the ``Draw-A-Secret'' (DAS) graphical
                 password scheme of Jermyn et al. [1999] as an example.
                 We analyze the size of these classes for DAS under
                 convenient parameter choices and show that they can be
                 combined to define apparently popular subspaces that
                 have bit sizes ranging from 31 to 41---a surprisingly
                 small proportion of the full password space (58 bits).
                 Our results quantitatively support suggestions that
                 user-drawn graphical password systems employ measures,
                 such as graphical password rules or guidelines and
                 proactive password checking.",
  acknowledgement = ack-nhfb,
  articleno =    "5",
  fjournal =     "ACM Transactions on Information and System Security",
  journal-URL =  "http://portal.acm.org/browse_dl.cfm?idx=J789",
  keywords =     "dictionary attack; Draw-a-Secret; graphical
                 dictionary; Graphical passwords; memorable passwords;
                 modeling user choice; password complexity factors",
}

Related entries