Creating Usable Policies for Stronger Passwords with MTurk

摘要: People are living increasingly large swaths of their lives through online accounts. These accounts brimming with sensitive data, and they often protected only by a text password. Attackers can break into service providers steal the hashed password files that store users’ passwords. This lets attackers make number guesses to crack The stronger is, more difficult it is for an attacker guess. Many have implemented password-composition policies. policies constrain or restrict passwords in order prevent users from creating easily guessed Too lenient policy may permit cracked passwords, too strict encumber users. ideal balances security usability. Prior work this thesis, many were based on heuristics speculation, rather than scientific analysis. Passwords research examined constructed under single uniform policy, unknown In I contrast strength usability created different do online, crowdsourced human-subjects studies randomized, controlled result comparison how affect both studied range policies, including those similar found wild, trade requiring longer which system-assigned known security. One contribution thesis tested methodology collecting Another between find some favorable tradeoffs usability, allowing evidence-based recommendations providers. also offer insights researchers interested conducting larger-scale studies, having collected data tens thousands participants.