Abstract
Challenge questions are commonly used as a backup should users forget their “main” authentication secret. Such questions are notoriously difficult to design properly, and have sometimes allowed intruders to access the system via a back door simply by engaging in some online research about the victim. The problem is that most challenge questions rely on a user’s knowledge of their early life, something which tends not to deteriorate over time. Unfortunately, this kind of information can also be discovered by a determined attacker. We developed a challenge protocol in which a set of pictorial cues are used to prompt answers, rather than using the standard mechanism based on textual questions. The prompts solicit associative memories that need not represent factual information (information that aids an attacker in mounting targeted observation attacks) and serve as a stronger cue to aid the recall. Our results reveal that the solution has comparable security with that of traditional challenge questions, and may offer increased protection against external attackers. Furthermore, we obtained a 13% increase in the memorability of our answers, hence enhanced effectiveness of the mechanism. We conclude by discussing how further modifications could achieve even greater gains on the usability front.
Original language | English |
---|---|
Title of host publication | People and Computer XXIV Games are a Serious Business |
Subtitle of host publication | Proceedings of HCI 2010 The 24th BCS Interaction Specialist Group Conference University of Abertay, Dundee, UK 6-10 September 2010 |
Place of Publication | Swindon |
Publisher | British Informatics Society Limited |
Pages | 98-107 |
Number of pages | 10 |
ISBN (Print) | 9781780171302 |
Publication status | Published - 6 Sep 2010 |
Event | 24th BCS Interaction Specialist Group Conference - University of Abertay, Dundee, United Kingdom Duration: 6 Sep 2010 → 10 Sep 2010 |
Conference
Conference | 24th BCS Interaction Specialist Group Conference |
---|---|
Abbreviated title | BCS '10 |
Country/Territory | United Kingdom |
City | Dundee |
Period | 6/09/10 → 10/09/10 |
Other | BCS-HCI: British Computer Society Conference on Human-Computer Interaction |
Keywords
- challenge questions
- pictorial cues
- challenge protocol
- associative memories