Search

While it is not recommended, Internet users tend to include personal information in their passwords for easy memorization. However, the use of personal information in passwords and its security implications have yet to be studied. In this paper, we dissect user passwords from several leaked data sets to investigate the extent to which a user’s personal information resides in a password. Then, we introduce a new metric called coverage to quantify the correlation between passwords and personal information. Afterward, based on our analysis, we extend the probabilistic context-free grammars (PCFGs) method to be semantics-rich and propose personal-PCFG to crack passwords by generating personalized guesses. Through offline and online attack scenarios, we demonstrate that personal-PCFG cracks passwords much faster than PCFG and makes online attacks much more likely to succeed. To defend against such semantics-aware attacks, we examine the use of simple distortion functions that are chosen by users to mitigate unwanted correlation between personal information and passwords.

Distribution of resources and services via open network has becoming latest trend in information technology. This is provided by many service provider servers. In open network, hackers can easily obtain the communication data. Therefore, open networks and servers demand the security to protect data and information. Hence, network security is most important requirement in distributed system. In this security system, authentication is considered as the fundamental and essential method. Recently many remote user authentication schemes are proposed. In 2012, WANG Ding et al. proposed a remote user authentication scheme, in which the author stated that the scheme provides protection against offline password guessing, impersonation and other known key attacks. By cryptanalysis we have identified that, WANG Ding et al.'s scheme does not provide user anonymity, once the smart card is stolen. This scheme is also susceptible to offline password guessing attack, server masquerading attack, stolen smart card attack and insider attack. Further, this scheme still has problem with proper perfect forward secrecy and user revocation. In order to fix these security weaknesses, an enhanced authentication scheme is proposed and analysed using the formal verification tool for measuring the robustness. From the observation of computational efficiency of the proposed scheme, we conclude that the scheme is more robust and easy to implement practically.

Objectives: Security of textual passwords is increased against offline guessability attacks by using different encryption methods. However, even after encryption textual passwords may be guessed through brute-force or dictionary attacks. Method: In this paper, a theoretical framework is developed which provides guidelines for improving password security against offline guessability attacks such as brute force and dictionary attacks. In the proposed framework different password security layers are defined which convert a password into a form which is very difficult to crack through offline guessability attacks. The framework layers are implemented at application and database level. Findings: In the proposed framework a short and easy to remember password string is converted into a long and random string which does not provide any hint of original password. However, it is important that the methodology or logic used for implementing the framework layers should be hidden from the attackers because the layers’ methodology may provide a clue for password cracking. Layers of the proposed framework can be implemented with different logics, which are helpful in hiding the implementation details of the layers. Application/Improvements: Proposed framework is not only helpful for improving security of traditional textual password scheme but it can also improve the security for graphical password schemes against offline guessability attacks. Keywords: Authentication, Guessability Attacks, Privacy, Password Security, Textual Passwords

The passwords for authenticating users are susceptible to shoulder-surfing attacks in which attackers learn users' passwords through direct observations without any technical support. A straightforward solution to defend against such attacks is to change passwords periodically or even constantly, making the previously observed passwords useless. However, this may lead to a situation in which users run out of strong passwords they can remember, or they are forced to choose passwords that are weak, correlated, or difficult to memorize. To achieve both security and usability in user authentication, we propose EvoPass , the first evolvable graphical password authentication system. EvoPass transforms a set of user-selected pass images to pass sketches as user credentials. Users are required to identify their pass sketches from a set of challenge images for user authentication. Particularly, EvoPass improves password strength gradually over time through continually degrading pass sketches without annoying users to reselect pass images. The evolving feature makes it difficult for observational adversaries to identify the pass sketches, even though part of pass sketches may have been exposed to adversaries previously. We introduce two metrics, Information Retention Rate (IRR) and Password Diversity Score (PDS) to guide the process of generating pass sketches and a set of challenge images. Our experimental analysis reveals that applying reasonable IRR and PDS in EvoPass can remarkably improve the resistance to shoulder-surfing attacks without negatively affecting user experience. We also implement a prototype of EvoPass on Android platform with reasonable IRR and PDS applied. Our experimental results on the prototype further demonstrate that EvoPass could work efficiently and achieve a desired usability.

In this paper, we conduct a large-scale study on the crackability, correlation, and security of ${\sim}145$ million real world passwords, which were leaked from several popular Internet services and applications. To the best of our knowledge, this is the largest empirical study that has been conducted. Specifically, we first evaluate the crackability of ${\sim}145$ million real world passwords against 6+ state-of-the-art password cracking algorithms in multiple scenarios. Second, we examine the effectiveness and soundness of popular commercial password strength meters (e.g., Google, QQ) and the security impacts of username/email leakage on passwords. Finally, we discuss the implications of our results, analysis, and findings, which are expected to help both password users and system administrators to gain a deeper understanding of the vulnerability of real passwords against state-of-the-art password cracking algorithms, as well as to shed light on future password security research topics.

A PAKR (Password-Authenticated Key Retrieval) protocol and its multi-server system allow one party (say, client), who has a memorable password, to retrieve a long-term static key in an exchange of messages with at least one other party (say, server) that has a private key associated with the password. In this paper, we analyze the only PAKR (named as PKRS-1) standardized in IEEE 1363.2 [9] and its multi-server system (also, [12] ) by showing that any passive/active attacker can find out the client’s password and the static key with off-line dictionary attacks. This result contradicts the security claims made for PKRS-1 (see Clause 10.2 of IEEE 1363.2 [9] ).

Password-based remote user authentication schemes using smart cards are designed to ensure that only a user who possesses both the smart card and the corresponding password can gain access to the remote servers. Despite many research efforts, it remains a challenging task to design a secure password-based authentication scheme with user anonymity. The author uses Kumari et al.’s scheme as the case study. Their scheme uses non-public key primitives. The author first presents the cryptanalysis of Kumari et al.’s scheme in which he shows that their scheme is vulnerable to user impersonation attack, and does not provide forward secrecy and user anonymity. Using the case study, he has identified that public-key techniques are indispensable to construct a two-factor authentication scheme with security attributes, such as user anonymity, unlinkability and forward secrecy under the nontamper resistance assumption of the smart card. The author proposes a password-based authentication scheme using elliptic ...

This study looks at the influence of user engagement on users’ information security practices. A model describing how user engagement (user posts) may influence a person’s decision to employ better security measures (stronger passwords) is tested. Password strength was determined by looking at password length, the types of characters used, the variety of character sequences used, the number of duplicate passwords, and the number of uncrackable passwords. Passwords were tested using a variety of cracking techniques. This study found that individuals from an online gaming site who made more posts to the user forum employed stronger passwords.

User’s password with smart card based authentication protocol is needed to access resources securely from remote server. In 2014, Huang et al. proposed a timestamp-based authentication protocol and they claimed that their scheme is secure against all possible attacks. In this paper, we have pointed out that Huang et al.’s scheme is insecure against off-line password guessing attack, insider attack and forgery attack. Beside these, inefficient password update phase can lead to denial of service. To remove these security loopholes, we have proposed an efficient RSA-cryptosystem based remote user authentication scheme using smart card. Security (formal and informal) analysis shows that the proposed scheme provides better security tradeoff than Huang et al.’s scheme. Further, we have simulated our proposed scheme for the formal security verification using Automated Validation of Internet Security Protocols and Applications tool to confirm that the proposed scheme is secure against passive and active attacks. Performance analysis shows that the proposed scheme provides lower computational and communication cost than Huang et al.’s scheme as well as other related competitive existing schemes.

User authentication is necessary to provide services on an application system and the Internet. Various authentication methods are used such as ID/PW, biometric, and OTP authentications. One of the popular authentications is ID/PW authentication. As an inputted password is transferred by one-way hash function and then stored in DB, it is difficult for the DB administrator to figure out the password inputted by the user. However, when DB is leaked, and there is the time to decode, the password can be hacked. The time and cost to decode the original message from the hash value corresponding a short password decrease. Therefore, if the password is short, then attacking cost is low, and password crack possibility is high. In the case where an attacker utilizes pre-computing rainbow tables, and the hash value of short passwords is leaked, the password that the user inputted can be cracked. In this research, to block rainbow table attacks, when the user generates a short password, by adding additional messages of identification information of a system or the user and extending the length of the password, we try to resolve the vulnerability of short passwords. By proposing a model to minimize the length of the password and the authority accordingly in mobile devices on which inputting passwords is not easy, we take security into consideration. Our proposal model is strong against rainbow table attack and provides efficient password system to users. It contributes to resolving password vulnerability and upgrades mobile users’ convenience in typing passwords.

Anonymous password authenticated key exchange (APAKE) allows a client holding a low-entropy password to establish a session key with a server in an authenticated and anonymous way. As a very convenient solution for personal privacy protection, it has attracted much attention in recent years. However, almost all existing APAKE protocols are designed in the random oracle model. In this paper, we propose the first password-only APAKE protocol (called APAKE-S) with proven security in the standard model, i.e., without random oracle heuristic. The resulting protocol guarantees AKE security, client anonymity and mutual authentication. Moreover, since the building blocks in our construction can be instantiated based on numerous hard assumptions (e.g., decisional Diffie–Hellman, Quadratic Residuosity, and N-residuosity assumptions), our APAKE-S protocol is actually a generic construction which implies a series of efficient APAKE protocols in the standard model.

Most graphical password systems on smart phones do not consider the needs of blind and visually impaired users. The main objective of this paper is to propose a new graphical authentication system which combines the usability of the graphical password with the security of the textual password and allows all types of users, including the blind and visually impaired users to use the same authentication system on a smartphone without any extra costs for special hardware. 84.6% of those surveyed would recommend BlindLogin to their friends. 46.2% of the respondents also found the BlindLogin password to be easier to remember than the regular textual password. BlindLogin is a viable alternative as a universal graphical password authentication system.

Das has improved the biometric-based remote user authentication using smart card [13]. This scheme is based on biometric, password, and the random nonce generated by the user and the server. It is very efficient as far as the computational cost is concerned. This scheme however has some security weaknesses such as replay and offline password guessing attacks. In this paper, we present a review of the Das’s scheme and discuss its weaknesses. In this paper, we develop a new scheme that overcomes all its weaknesses.

We propose – and experimentally test – a mnemonic variant of password security that uses game positions as passwords. In Experiment 1, we report accuracy and reaction time data when high school student, younger adult, and older adult participants remembered and entered one game-based password, using chess or Monopoly. In Experiment 2, we report accuracy and reaction time data from participants' use of five game-based passwords across 24 sessions over 10 weeks. All five passwords were stored in chess or Monopoly for the initial 20 sessions, and changed (from chess to Monopoly or vice versa) for the remaining sessions. This new approach to password security is both mathematically robust and user-friendly.

In parallel to the increasing purchase rate of the smart devices, attacks on these devices are also increasing in an alarming rate. To prevent these attacks, many password-based authentication schemes are proposed. Among them, graphical password schemes are preferred on these devices due to their limited screen size and a lack of full sized keyboard. Again, existing graphical password schemes are susceptible to various attacks, among which shoulder surfing, smudge attack, and brute force attack are the most prominent. Hence, in this paper, we propose Vibration-And-Pattern (VAP) code, a new graphical password scheme that is resilient against these three major attacks. To evaluate the usability of our proposed scheme, a usability study has been conducted on 122 participants of various age groups from different demographics.

Purpose The purpose of this research is to investigate user comprehension of ambiguous terminology in password rules. Although stringent password policies are in place to protect information system security, such complexity does not have to mean ambiguity for users. While many aspects of passwords have been studied, no research to date has systematically examined how ambiguous terminology affects user comprehension of password rules. Design/methodology/approach This research used a combination of quantitative and qualitative methods in a usable security study with 60 participants. Study tasks contained password rules based on real-world password requirements. Tasks consisted of character-selection tasks that varied the terms for non-alphanumeric characters to explore users’ interpretations of password rule language, and compliance-checking tasks to investigate how well users can apply their understanding of the allowed character space. Findings Results show that manipulating password rule terminology causes users’ interpretation of the allowed character space to shrink or expand. Users are confused by the terms “non-alphanumeric”, “symbols”, “special characters” and “punctuation marks” in password rules. Additionally, users are confused by partial lists of allowed characters using “e.g.” or “etc.” Practical implications This research provides data-driven usability guidance on constructing clearer language for password policies. Improving language clarity will help usability without sacrificing security, as simplifying password rule language does not change security requirements. Originality/value This is the first usable security study to systematically measure the effects of ambiguous password rules on user comprehension of the allowed character space.

Despite the number of users accessing and storing your personal information in cloud services has increased considerably, there still is a certain barrier regarding to cloud adoption. Data security and confidentiality can be considered one of main reasons that affect both sides, clients and cloud providers. Some techinques has been implemented to hamper the data violation and inapropriated access, such as two-factor authentication, that requires two or more factors to liberate the service access to an user. This work presents a performance analisys of two-factor authentication system considering three different virtual environments (KVM, Xen, and VMware Player hypervisors). For the two-factor authentication process, we use the traditional login and password mechanism, and the One Time Password (OTP), as second factor; and for the identity management, we use the OpenID protocol that allows a Single Sign One access. Results show KVM hypervisor has the best performance when compared to two others.

Graphical passwords (GPs) are recognised as one of the potential alternatives in addressing the limitations in conventional text-based password authentication. With the rapid development of mobile devices (i.e., the increase of computing power), GP-based systems have already been implemented not only on PCs, but also on smartphones to authenticate legitimate users and detect impostors. However, as compared to common computers, we identify that users are able to perform some distinct actions like multi-touch on smartphones. The multi-touch is a distinguished feature on current smartphones and its impact on graphical password creation is an important topic in the literature. In this paper, our interest is to investigate the influence of multi-touch behaviours on users' habit in creating graphical passwords, especially on click-draw based GPs (shortly CD-GPS) on mobile devices. In the evaluation, we develop a multi-touch enabled CD-GPS on smartphones and conduct two major experiments with a total of 90 participants. The study results indicate that participants are more likely to use multi-touch features to create their secrets, and multi-touch can make a positive impact on creating graphical passwords (i.e., offering higher success rates and less time consumption).

In order to provide secure remote access control, a robust and efficient authentication protocol should achieve mutual authentication and session key agreement between clients and the server over public channels. Recently, Wang et al. proposed a password based authentication protocol using chaotic maps. In this paper, we demonstrate the security of their scheme, and show that Wang et al.’s scheme cannot provide session key agreement and is insecure against denial of service attack for no detecting wrong password in password change. To remedy these issues, we use the techniques of fuzzy extractor and chaotic maps to propose a three-factor remote authentication scheme. The new scheme preserves user privacy and is secure against various attacks. Detailed analysis of previous schemes in efficiency and security shows our proposed scheme is more suitable for practical application.

Three-party authenticated key exchange (3PAKE) protocol allows two communication users to authenticate each other and to establish a secure common session key with the help of a trusted remote server. Recently, Farash and Attari propose an efficient and secure 3PAKE protocol based on Chebyshev chaotic maps and their protocol is supported by the formal proof in the random oracle model. However, in this paper, we analyze the security of Farash–Attari’s protocol and show that it fails to resist password disclosure attack if the secret information stored in the server side is compromised. In addition, their protocol is insecure against user impersonation attack and the server is not aware of having caused problem. Moreover, the password change phase is insecure to identify the validity of request where insecurity in password change phase can cause offline password guessing attacks and is not easily reparable. To remove these security weaknesses, based on Chebyshev chaotic maps and quadratic residues, we further design an improved protocol for 3PAKE with user anonymity. In comparison with the existing chaotic map-based 3PAKE protocols, our proposed 3PAKE protocol is more secure with acceptable computation complexity and communication overhead.

Despite frequent assertions that passwords are dead – and a web search for this phrase will throw up many such assertions – as well as increasing evidence of service providers moving away from them, they are currently very much with us in many contexts. Indeed, the fact that one of the first publications from the UK's newly-formed National Cyber Security Centre was a password infographic is a telling sign of where we currently are with password use and misuse. Passwords remain the most common form of authentication but continue to face various practical challenges, not least of which is getting users to make appropriate choices in the first place. Steven Furnell and Rawan Esmael of the University of Plymouth conducted a series of experiments to assess users' password creation behaviour with varying levels of support, ranging from unguided to feedback approaches using emoji-based indicators. The results reveal dramatic differences, but suggest there is still much work to be done to make passwords safe.

The authentication schemes for telecare medical information systems (TMIS) try to ensure secure and authorized access. ID-based authentication schemes address secure communication, but privacy is not properly addressed. In recent times, dynamic ID-based remote user authentication schemes for TMIS have been presented to protect user’s privacy. The dynamic ID-based authentication schemes efficiently protect the user’s privacy. Unfortunately, most of the existing dynamic ID-based authentication schemes for TMIS ignore the input verifying condition. This makes login and password change phases inefficient. Inefficiency of the password change phase may lead to denial of service attack in the case of incorrect input in the password change phase. To overcome these weaknesses, we proposed a new dynamic ID-based authentication scheme using a smart card. The proposed scheme can quickly detect incorrect inputs which makes the login and password change phase efficient. We adopt the approach with the aim to protect privacy, and efficient login and password change phases. The proposed scheme also resists off-line password guessing attack and denial of service attack. We also demonstrate the validity of the proposed scheme by utilizing the widely-accepted BAN (Burrows, Abadi, and Needham) logic. In addition, our scheme is comparable in terms of the communication and computational overheads with relevant schemes for TMIS.

Security of authentication is needed to be provided superlatively to secure users personal and exchange information since online information exchange systems have been developed according to internet speed. Therefore, the aim of this paper is to develop existing graphical password scheme based on one's memory, create and implement a new graphical password scheme that composed of three layer verification. We programmed our scheme in order to prove its superiority comparing with existing schemes. While we conducted survey on user by accessing participant to our system lied in participants local network and we analyzed in accordance with the average length of their created password and statistical significant of entropy bit. From the survey results of total participants, we find that our scheme has statistical significant, furthermore it was proved that it can secure from a variety of attacks due to its high entropy.

Devices with 3D capabilities are quickly gaining in popularity. In this paper, we propose to bring authentication into the third dimension. We define the concept of a 3D authentication scheme based on physical and psychological advantages of 3D. We implement an example of 3D authentication: 3DPass, to demonstrate the superiority of the 3D approach. Our security analysis of 3DPass demonstrates that 3DPass can exceed the password space of an 8 character alphanumeric password with just 6 choices. Our user study finds that 3DPass has superior memorability versus traditional alphanumeric passwords: 98% vs 83% recall rates after one week. We find that passwords in our scheme can be entered in 21 seconds on average when used with the Oculus Rift. We find that using the Oculus Rift improves entry time compared to a traditional 2D display, despite having no impact on presence (the feeling of “being there”) or user preference.

Authentication plays a critical role in securing any online banking system, and many banks and various services have long relied on username/password combos to verify users. Memorizing usernames and passwords for a lot of accounts becomes a cumbersome and inefficient task. Furthermore, legacy authentication methods have failed over and over, and they are not immune against a wide variety of attacks that can be launched against users, networks, or authentication servers. Over the years, data breach reports emphasize that attackers have created numerous high-tech techniques to steal users’ credentials, which can pose a serious threat. In this paper, we propose an efficient and practical user authentication scheme using personal devices that utilize different cryptographic primitives, such as encryption, digital signature, and hashing. The technique benefits from the widespread usage of ubiquitous computing and various intelligent portable and wearable devices that can enable users to execute a secure authentication protocol. Our proposed scheme does not require an authentication server to maintain static username and password tables for identifying and verifying the legitimacy of the login users. It not only is secure against password-related attacks, but also can resist replay attacks, shoulder-surfing attacks, phishing attacks, and data breach incidents.

In remote user authentication, a server confirms the authenticity of a user via unreliable channel. Several authentication protocols are devised in the literature relied on the identity, password and biometric of a user. But, most of the authentication protocols are either computationally expensive or not-secure from several kinds of malicious threats. In this document, the authors have suggested a secure and robust three-factor (such as password, smartcard and biometric) based authentication scheme by using RSA cryptosystem. The proposed protocol is validated through BAN logic. Then, formal security analysis using random oracle model shows that the identity, password, biometric and session key are highly secure from an adversary. Besides, the informal security analysis of our protocol proves that it withstands to several kinds of malicious attacks. In addition, performance comparison of presented scheme with respect to other schemes is comparatively suitable in the context of communication and computation costs.

In this work, we present a simple, yet effective and practical scheme to improve the security of stored password hashes, increasing the difficulty to crack passwords and exposing cracking attempts. We utilize a hardware-dependent function (HDF), such as a physically unclonable function (PUF) or a hardware security module (HSM), at the authentication server to inhibit offline password discovery. Additionally, a deception mechanism is incorporated to alert administrators of cracking attempts. Using an HDF to generate password hashes hinders attackers from recovering the true passwords without constant access to the HDF. Our scheme can integrate with legacy systems without needing additional servers, changing the structure of the hashed password file, nor modifying client machines. When using our scheme, the structure of the hashed passwords file, e.g., etc/shadow or etc/master.passwd , will appear no different than traditional hashed password files. 1 However, when attackers exfiltrate the hashed password file and attempt to crack it, the passwords they will receive are ErsatzPasswords—“fake passwords.” The ErsatzPasswords scheme is flexible by design, enabling it to be integrated into existing authentication systems without changes to user experience. The proposed scheme is integrated into the pam_unix module as well as two client/server authentication schemes: Lightweight Directory Access Protocol (LDAP) authentication and the Pythia pseudorandom function (PRF) Service [Everspaugh et al. 2015]. The core library to support ErsatzPasswords written in C and Python consists of 255 and 103 lines of code, respectively. The integration of ErsatzPasswords into each explored authentication system required less than 100 lines of additional code. Experimental evaluation of ErsatzPasswords shows an increase in authentication latency on the order of 100ms, which maybe acceptable for real world systems. We also describe a framework for implementing ErsatzPasswords using a Trusted Platform Module (TPM).

Authentication plays a major role in ensuring the security of the system by allowing only the authorized user. The traditional authentication system of using text-based passwords has many flaws in the aspects of usability and security issues. Hence, graphical passwords, which consist of clicking or dragging activities on the pictures rather than typing textual characters, were introduced to overcome this problem. However, it is found that these graphical passwords are susceptible to brute force and dictionary attack methods. To overcome this drawback, images can be used as password replacing alphanumeric and graphical passwords. The challenge lies in encrypting the image password and storing it in the database. An image edge password encryption (IEPE) algorithm is proposed to encrypt the image passwords based on its edge values. Experimental results are shown to prove that encrypted image passwords using IEPE algorithm requires a less internal storage space when compared with the existing password encryption techniques. It is also shown that IEPE algorithm scales better when compared with the existing text-based and graphical password authentication methods. Also, IEPE algorithm is shown to resist various password cryptanalytic attacks. Copyright © 2017 John Wiley & Sons, Ltd.

Purpose The purpose of this paper is to increase security using persuasive cued click points (PCCP) techniques and to make a system to provide security from the malware, key loggers and attacks. Design/methodology/approach The work methodology comprises two major phases. In phase one, the PCCP take place with the registration and login process done. It also includes text-based password which hides the character of password to protect from shoulder surfing attack. In phase two, the work includes background services which protect from key loggers. Findings Secure password persuasive cued click point (SPPCCP) is a module that facilitates authentication for the desktop-based applications and provides a single-machine licensing functionality. SPPCCP comprises little functionality to thwart attackers, such as persuasive click points with password protection. The techniques to protect against malware such as resist from debuggers and also to the key loggers that run on desktop computers. In this, Spearman rank correlation is used for detection of key loggers. There are functionalities used to secure desktop applications such as time constraint and user selection. Originality/value The contribution of this paper is to provide knowledge in the field of security. It makes the graphical password more secure and useful. The intention behind this research was to increase the security level up to 60-80 per cent. It is also used for prevention of shoulder surfing problem till 80 per cent; this research is also operated on key loggers, and SPPCCP finds the key loggers and removes it from the system. It also decrypts the data of database by encrypting it by SHA-512 algorithm and reduces the average login time up to 20-30 per cent; it will make a smaller view port of 33.5 × 33.5 pixel square to have more choice to select the password, thereby decreasing the probability of hotspot area up to 18-20 per cent.

Purpose This paper aims to present reports of widespread security breaches that reveal the personal information and passwords of thousands, or even millions, of people that are now unfortunately commonplace. Design/methodology/approach In an increasingly digital world, often the only thing protecting an individual’s information is a password or other similar security measure. Findings Libraries have an important role to play in confronting this issue, both as mediators of digital literacies and as organizations that typically require passwords from their patrons. Social implications In addition to providing access to services through passwords, libraries set their own policies. Originality/value This column will explore the evolving technological landscape and review tools libraries can use to help patrons keep their information safe.

Security issues in text-based password authentication are rarely caused by technical issues, but rather by the limitations of human memory, and human perceptions together with their consequential responses. This study introduces a new user-friendly guideline approach to password creation, including persuasive messages that motivate and influence users to select more secure and memorable text passwords without overburdening their memory. From a broad understanding of human factors-caused security problems, we offer a reliable solution by encouraging users to create their own formula to compose passwords. A study has been conducted to evaluate the efficiency of the proposed password guidelines. Its results suggest that the password creation methods and persuasive message provided to users convinced them to create cryptographically strong and memorable passwords. Participants were divided into two groups in the study. The participants in the experimental group who were given several password creation methods along with a persuasive message created more secure and memorable passwords than the participants in the control group who were asked to comply with the usual strict password creation rules. The study also suggests that our password creation methods are much more efficient than strict password policy rules. The security and usability evaluation of the proposed password guideline showed that simple improvements such as adding persuasive text to the usual password guidelines consisting of several password restriction rules make significant changes to the strength and memorability of passwords. The proposed password guidelines are a low-cost solution to the problem of improving the security and usability of text-based passwords.

In today’s digital age, the digital transformation is necessary for almost every competitive enterprise in terms of having access to the best resources and ensuring customer satisfaction. However, due to such rewards, these enterprises are facing key concerns around the risk of next-generation data security or cybercrime which is continually increasing issue due to the digital transformation four essential pillars—cloud computing, big data analytics, social and mobile computing. Data transformation-driven enterprises should ready to handle this next-generation data security problem, in particular, the compromised user credential (CUC). When an intruder or cybercriminal develops trust relationships as a legitimate account holder and then gain privileged access to the system for misuse. Many state-of-the-art risk mitigation tools are being developed, such as encrypted and secure password policy, authentication, and authorization mechanism. However, the CUC has become more complex and increasingly critical to the digital transformation process of the enterprise’s database by a cybercriminal, we propose a novel technique that effectively detects CUC at the enterprise-level. The proposed technique is learning from the user’s behavior and builds a knowledge base system (KBS) which observe changes in the user’s operational behavior. For that reason, a series of experiments were carried out on the dataset that collected from a sensitive database. All empirical results are validated through well-known evaluation measures, such as (i) accuracy, (ii) sensitivity, (iii) specificity, (iv) prudence accuracy, (v) precision, (vi) f-measure, and (vii) error rate. The experiments show that the proposed approach obtained weighted accuracy up to 99% and overall error of about 1%. The results clearly demonstrate that the proposed model efficiently can detect CUC which may keep an organization safe from major damage in data through cyber-attacks.

Organizations worldwide are revisiting the design of their password policies. This is partly motivated by the security and usability limitations of user-generated passwords. While research on password policies has been ongoing, this has taken place in the Global North. Accordingly, little is known about the strengths and weaknesses of password policies deployed in the Global South, especially Africa. As such, this study researched password policies deployed on South African websites. Password policies of thirty frequently visited websites belonging to South African organizations were analyzed. Our observations show diverse password requirements. Even though the desire for strong passwords is the dominant motivator of complex password policies, South African organizations often adopt obsolete measures for attaining password security. The ten most common passwords in the literature were considered acceptable on most sites. In addition, some sites did not explicitly display password requirements and only a few sites adopted measures for providing real-time feedback and effective guidance during password generation.

Samhället blir mer digitaliserat och fler människor kopplar upp sig mot Internet. Detta innebär att många arbetsuppgifter som hanterar känsliga uppgifter nu utförs på datorer. Det finns även många tjänster som kräver personligauppgifter för att registrera sig och kontouppgifter för att beställa varor eller prenumerera till tjänsten. Denna information är av intresse för brottslingar som kan använda denna för att tjäna pengar. Som en konsekvens av detta har användningen av lösenord ökat och för att försäkra att starka lösenord skapas följs riktlinjer. Dessa lösenordsriktlinjer skapas och sprids ofta utav myndigheter och andra expertorganisationer. Dock saknar de källor för var riktlinjerna kommer ifrån och en förklarning för hur de skapades. För att belysa detta ämnar studien att eftersöka riktlinjernas ursprung och vad dessa baserades på. Detta är en kvalitativ studie där intervjuer gjorts med informationssäkerhetspecialister från tre myndigheter och en expertorganisation. För att bearbeta data från dessa intervjuer har en tematisk analys utförts för att identifiera de olika källorna som använts vid skapandet av riktlinjerna. Studiens resultat visar att motivationen för riktlinjerna varierar mellan organisationerna. Detta kan observeras genom skillnader i deras målgrupp och fokus. Det har även visat sig att det inte finns några studier att hänvisa till. Dock är ett genomgående mönster att källorna för riktlinjerna ofta verkar vara baserade på de anställdas erfarenheter och expertis. Förutom detta tas inspiration för riktlinjerna från organisationer som NIST. Society is getting more digitalized and more people are connecting to the Internet. This means that a lot of work that handles sensitive information is now done using computers. There is also a lot of services that requires personal information for registration and bank account information to order wares or subscribe to the service. This information is of interest to criminal who can use it to make money. Because of this the use of passwords has increased and to make sure that strong passwords are created guidelines are adhered to. The password guidelines are created and spread by authorities and expert organizations. However, there are no sources for where the guidelines came from or an explanation for how they were made. To shine a light on this, the study aims to explain the guidelines origins and what they were based on. This is a qualitative study where interviews were done with information security specialists from three governmental bodies and one expert organization. After the interviews were completed and data collected, they were analyzed using thematic analysis to identify the sources that were used during the creation of the guidelines. The study’s results show that the motivation for the guidelines vary. This can be observed through the differences in target group and focus. It also appears like there are no studies which could be referred to. Although there is a consistent pattern that the sources for the guidelines often seems to be based on the experiences and expertise of their employees. Except for this, inspiration is also drawn from organizations such as NIST.

Using automotive smartphone applications (apps) provided by car manufacturers may offer numerous advantages to the vehicle owner, including improved safety, fuel efficiency, anytime monitoring of vehicle data, and timely over-the-air delivery of software updates. On the other hand, the continuous tracking of the vehicle data by such apps may also pose a risk to the car owner, if, say, sensitive pieces of information are leaked to third parties or the app is vulnerable to attacks. This work contributes the first to our knowledge full-fledged security assessment of all the official single-vehicle management apps offered by major car manufacturers who operate in Europe. The apps are scrutinised statically with the purpose of not only identifying surfeits, say, in terms of the permissions requested, but also from a vulnerability assessment viewpoint. On top of that, we run each app to identify possible weak security practices in the owner-to-app registration process. The results reveal a multitude of issues, ranging from an over-claim of sensitive permissions and the use of possibly privacy-invasive API calls, to numerous potentially exploitable CWE and CVE-identified weaknesses and vulnerabilities, the, in some cases, excessive employment of third-party trackers, and a number of other flaws related to the use of third-party software libraries, unsanitised input, and weak user password policies, to mention just a few.

Purpose Two-factor authentication is being implemented more broadly to improve security against phishing, shoulder surfing, keyloggers and password guessing attacks. Although passwords serve as the first authentication factor, a common approach to implementing the second factor is sending a one-time code, either via e-mail or text message. The prevalence of smartphones, however, creates security risks in which a stolen phone leads to user’s accounts being accessed. Physical tokens such as RSA’s SecurID create extra burdens for users and cannot be used on many accounts at once. This study aims to improve the usability and security for two-factor online authentication. Design/methodology/approach The authors propose a novel second authentication factor that, similar to passwords, is also based on something the user knows but operates similarly to a one-time code for security purposes. The authors design this component to provide higher security guarantee with minimal memory burden and does not require any additional communication channels or hardware. Motivated by psychology research, the authors leverage users’ autobiographical memory in a novel way to create a secure and memorable component for two-factor authentication. Findings In a multi-session lab study, all of the participants were able to log in successfully on the first attempt after a one-week delay from registration and reported satisfaction on the usability of the scheme. Originality/value The results indicate that the proposed approach to leverage autobiographical memory is a promising direction for further research on second authentication factor based on something the user knows.

Cloud Computing is a new technology that allows access to applications as utilities over the internet. Cloud computing environment provides a great flexibility and availability of computing resources at a lower cost. However, it brings new security concerns mainly when users understand exactly how a process is running. One of the main important challenges in cloud computing is data security, as users need to access data they share securely. So the main problem is how to employ an effective authentication procedure for ensuring data security and preventing unauthorized users to access the authorized user’s data. This paper identifies the security issues of single level authentication and the problem of single password. This study proposed a new security mechanism for cloud computing based on multilevel authentication. The proposed scheme aimed to enhance the security and authentication process in cloud computing. The proposed scheme consists of three level of authentication, and the data will be splitting on this level depending on the sensitivity to confidential (C), secret (S), and top secret (TS). Data at level (C) have the lowest sensitivity. The user at this level has single textual password to access this level data. The user at level (S) has two passwords, textual and biometrics password to access this level and the lower level. User at level (TS) has three password textual, biometrics password and image sequencing password. The data at this level is the more sensitive data so it is encrypted using RSA algorithm before storing in cloud database. The results of the proposed multilevel authentication for cloud computing were promising.

Keystroke Dynamics is one of the well-known and economical behavioral biometric developments that attempt to recognize the genuineness of a client when the client invokes his keystrokes from a computer keyboard. The keystrokes pattern helps to determine the typing behaviour of users of the system thus serves as the benchmark for identity verification. This paper displays the use of biometrics to augment traditional passwords security in computer web-based application systems. The system was evaluated base on these criteria; authenticating legitimate user against imposter user and a guess imposter user of the system. Also, evaluation of character timings was performed to know the best combination of strings to use in setting passwords in systems where keystroke dynamics would be applied in order to achieve high efficiency. This study concludes that the use of keystrokes dynamics in augmenting password security in computer web-based applications should be embraced. General Terms Keystroke dynamics web-based application.

Although many aspects of passwords have been studied, no research to date has systematically examined how ambiguous terminology affects the user experience during password rule comprehension, a necessary precursor to password generation. Our research begins to address this gap by focusing on users’ comprehension of password generation rules. Varying terms—special characters, symbols, non-alphanumeric characters, and punctuation—are used in different password rules, but mostly without explicit definition. In this laboratory study, we used character-selection and compliance-checking tasks with 60 participants to investigate effects of varying terms on users’ password rule comprehension. Results show that manipulating terminology caused participants’ interpretation of the allowed character space to shrink or expand. Our quantitative and qualitative data show that participants were extremely confused by the variety of terms for “special character.” Seemingly small changes in language have large, observable impacts on users’ understanding of password rules. Language in password requirements must be carefully constructed to ensure that users fully comprehend the allowable character space. This research is an important first step to providing data-driven guidance on constructing clearer language for password rules.

We design and explore the usability and security of two geographic authentication schemes: GeoPass and GeoPassNotes. GeoPass requires users to choose a place on a digital map to authenticate with (a location password). GeoPassNotes—an extension of GeoPass—requires users to annotate their location password with a sequence of words that they can associate with the location (an annotated location password). In GeoPassNotes, users are authenticated by correctly entering both a location and an annotation. We conducted user studies to test the usability and assess the security of location passwords and annotated location passwords. The results indicate that both the variants are highly memorable, and that annotated location passwords may be more advantageous than location passwords alone due to their increased security and the minimal usability impact introduced by the annotation.

Graphical passwords offer a more memorable alternative to traditional, text-based passwords. Among current contenders, cued-recall based click-point or gesture centered authentication systems like Microsoft’s picture gesture authentication (PGA) have been commercially more successful than recognition based systems (e.g., PassFaces). One perceived drawback of graphical authentication systems in general and especially recognition based authentication is the assumption that graphical authentication is slower and thus less user-friendly than traditional password entry via keyboard. This paper addresses these concerns and demonstrates a lower limit for recognition-based password entry times achievable with sufficient practice. While slightly slower than traditional keyboard based passwords, the entry speed of often-used graphical passwords is shown to reach 10 bits/s in an optimized configuration, which is sufficient for everyday use (3-6s per authentication sequence @ 36 bits) and exceeds the reported speed of similarly secure text-based passwords on non-traditional devices using virtual keyboards.

The graphical password patterns are in the rising trend in world with the abundance of the touch screen devices. A variety of touch screen devices are present for the users such as mobile phones, tables, touch-enabled laptops, touchenabled notebooks, etc. The graphical password has evolved with the invention of the touch-screen devices. The popular graphical schemes known as Pass-Go Pattern, Pass-point pattern and other similar schemes has been studied for the development of the new graphical password scheme. The existing models based upon pass-go and pass-point model stays as the basic model for our research for the development of the effective and secure graphical password scheme. It becomes difficult to input the alphanumeric passwords on the touch screens. The alphanumeric input lacks the high order accuracy as well as requires more focus to input the password. Most of the popular schemes have used the 3x3, 3x4 or 4x3 point-grid method for prompting the patterns to the users. The clue-point method is another popular method to display the graphical grid for the password input. In the proposed graphical model, graphical authentication model based upon the images has been aimed at to resolve the issues persisting in the existing models. In this model, the shuffling pattern based method has been used for the mitigation of the shoulder surfing attacks. The shuffling pattern scheme changes the primary display for password input every-time, which also restructure the input grid to overcome the threat caused by the shoulder surfing attacks.The proposed model has been designed to offer the robust graphical password scheme with the face images randomly collected by the users. The random point module for the visualization of the password input module plays the key role in the proposed graphical password scheme. The proposed model is a circular point model where the points are placed on the circle and the images are drawn on the given points. The user has to input the graphical pattern by joining the images with each other in the certain sequence. The proposed model requires less focus and highly accurate and easy to use. The experimental results have been evaluated in the factors associated with the study of the usability, memorabiltiy and difficulty in password creation. The proposed model has been compared against the existing models on the basis of the latter factors, where the proposed model has outperformed the existing models.

Due to increasing security awareness of password from the public and little attention on the characteristics of real-life passwords, it is thus natural to understand the current state of characteristics of real-life passwords, and to explore how password characteristics change over time and how earlier password practice is understood in current context. In this work, we attempt to present an in-depth and comprehensive understanding of user practice in real-life passwords, and to see whether the previous observations can be confirmed or reversed, based on large-scale measurements rather than anecdotal knowledge or user surveys. Specifically, we measure password characteristics on over 6 million passwords, in terms of password length, password composition, and password selection. We then make informed comparisons of the findings between our investigation and previously reported results. Our general findings include: (1) average password length is at least 12% longer than previous results, and 75% of our passwords have the length between 8 and 10 characters; (2) there is a significant increase of using only numbers as passwords, and easy-to-reach symbols are always the first choice when users added symbols into passwords; (3) there observes a remarkable increase (about 40%) of using combo-meaningful data as passwords, and a striking proportion of using the most common passwords or login names as passwords. Our investigation also includes collecting statistics about the use of symbols, letter-case, and meaningful details, which presents a systematic analysis of password usage. The comparative results indicate that the password characteristics and password practice on this massive password data set are somewhat inconsistent with those from anecdotal knowledge and user surveys, and exhibit a substantial change over time in some ways. Further research needs to build upon this understanding for gaining insight into how password security can be improved.

Passwords can be used to gain access to specific data, an account, a computer system or a protected space. A single user may have multiple accounts that are protected by passwords. Research shows that users tend to keep same or similar passwords for different accounts with little differences. Once a single password becomes known, a number of accounts can be compromised. This paper deals with password security, a close look at what goes into making a password strong and the difficulty involved in breaking a password. The following sections discuss related work and prove graphically and mathematically the different aspects of password securities, overlooked vulnerabilities and the importance of passwords that are widely ignored. This work describes tests that were carried out to evaluate the resistance of passwords of varying strength against brute force attacks. It also discusses overlooked parameters such as entropy and how it ties in to password strength. This work also discusses the password composition enforcement of different popular websites and then presents a system designed to provide an adaptive and effective measure of password strength. This paper contributes toward minimizing the risk posed by those seeking to expose sensitive digital data. It provides solutions for making password breaking more difficult as well as convinces users to choose and set hard-to-break passwords.

Today’s era is the era of Smart phones. Smart phones are continually becoming smaller, more powerful and can perform variety of tasks. The data generated by these devices need to be stored and accessed securely. One example of such sensitive data is password. Computer users are increasingly using password for online accounts, email servers, ecommerce sites, financial services and social media websites and it is always advisable that passwords should be complex and reuse of passwords should be avoided. Therefore this leads to a challenge of remembering several complex passwords for various applications, something an average human being is not very good at. In this paper, a Password Manager, an Android Application is proposed. This password manager takes login credentials (Email Address & Password) as input from user which is then being encrypted using Blowfish algorithm and finally the cipher is stored inside an image selected by user using LSB (least Significant Bit) Technique. A typical password manager uses database to store all login credentials but our proposed approach replaces database with image and stores all login credentials inside an image and in turn providing dual layer security of data that uses combination of both cryptography and steganography in which first layer is to scramble information using Blowfish Algorithm and second layer is insertion of scramble information inside an Image using least significant approach (LSB). Finally, performance analysis of cover-image and stego-image shows that image quality is preserved in terms of MSE and PSNR

All Database Management Systems used in the industry provide secure access to data at the server level. The level of security is influenced by technology, security model, password encryption method, password strength and others. The human factor – unreasonable behaviour of users – also has a significant impact on safety. Developers of database applications often implement their security policy by limiting the risk caused by users. This implementation has a disadvantage – it does not work outside of the application. A large number and variety of applications that work with the database server may then create a security gap. The paper presents the authors’ extensions of the functional features implemented in the Oracle database server, increasing the security of data access. The implemented methods of controlling the time of user access to data and limiting the use of serial and modular passwords are also discussed.