Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords. Blocki, J., Komanduri, S., Cranor, L., F., & Datta, A. In Proceedings of the Network and Distributed Systems Security Symposium (NDSS), 2, 2015. ![Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords [link]](https://bibbase.org/img/filetypes/link.svg "link")
Website abstract bibtex We report on a user study that provides evidence that spaced repetition and a specific mnemonic technique enable users to successfully recall multiple strong passwords over time. Remote research participants were asked to memorize 4 Person-Action-Object (PAO) stories where they chose a famous person from a drop-down list and were given machine-generated random action-object pairs. Users were also shown a photo of a scene and asked to imagine the PAO story taking place in the scene (e.g., Bill Gates swallowing bike on a beach). Subsequently, they were asked to recall the action-object pairs when prompted with the associated scene-person pairs following a spaced repetition schedule over a period of 100+ days. While we evaluated several spaced repetition schedules, the best results were obtained when users initially returned after 12 hours and then in 1.5x increasing intervals: 77.1% of the participants successfully recalled all 4 stories in all 9 tests over a period of 102 days. Much of the forgetting happened in the first test period (12 hours): on average 94.9% of the participants who had remembered the stories in earlier rounds successfully remembered them in subsequent rounds. These findings, coupled with recent results on naturally rehearsing password schemes, suggest that 4 PAO stories could be used to create usable and strong passwords for 14 sensitive accounts following this spaced repetition schedule, possibly with a few extra upfront rehearsals. In addition, we find statistically significant evidence that initially (8 tests over 64 days) users who were asked to memorize 4 PAO stories outperform users who are given 4 random action-object pairs, but eventually (9 tests over 128 days) the advantage is not significant. Furthermore, there is an interference effect across multiple PAO stories: the recall rate of 100% for participants who were asked to memorize 1 or 2 PAO stories is significantly better than that for 4 PAO stories. These findings yield concrete advice for improving constructions of password management schemes and future user studies.
@inProceedings{
title = {Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords},
type = {inProceedings},
year = {2015},
identifiers = {[object Object]},
keywords = {memorability,memory,passwords},
websites = {http://www.internetsociety.org/doc/spaced-repetition-and-mnemonics-enable-recall-multiple-strong-passwords},
month = {2},
id = {0437bed1-df41-390a-abc3-dc446886554a},
created = {2018-07-12T21:31:35.941Z},
file_attached = {false},
profile_id = {f954d000-ce94-3da6-bd26-b983145a920f},
group_id = {b0b145a3-980e-3ad7-a16f-c93918c606ed},
last_modified = {2018-07-12T21:31:35.941Z},
read = {false},
starred = {false},
authored = {false},
confirmed = {true},
hidden = {false},
citation_key = {blocki:spaced15},
source_type = {inproceedings},
private_publication = {false},
abstract = {We report on a user study that provides evidence that spaced repetition and a specific mnemonic technique enable users to successfully recall multiple strong passwords over time. Remote research participants were asked to memorize 4 Person-Action-Object (PAO) stories where they chose a famous person from a drop-down list and were given machine-generated random action-object pairs. Users were also shown a photo of a scene and asked to imagine the PAO story taking place in the scene (e.g., Bill Gates swallowing bike on a beach). Subsequently, they were asked to recall the action-object pairs when prompted with the associated scene-person pairs following a spaced repetition schedule over a period of 100+ days. While we evaluated several spaced repetition schedules, the best results were obtained when users initially returned after 12 hours and then in 1.5x increasing intervals: 77.1% of the participants successfully recalled all 4 stories in all 9 tests over a period of 102 days. Much of the forgetting happened in the first test period (12 hours): on average 94.9% of the participants who had remembered the stories in earlier rounds successfully remembered them in subsequent rounds. These findings, coupled with recent results on naturally rehearsing password schemes, suggest that 4 PAO stories could be used to create usable and strong passwords for 14 sensitive accounts following this spaced repetition schedule, possibly with a few extra upfront rehearsals. In addition, we find statistically significant evidence that initially (8 tests over 64 days) users who were asked to memorize 4 PAO stories outperform users who are given 4 random action-object pairs, but eventually (9 tests over 128 days) the advantage is not significant. Furthermore, there is an interference effect across multiple PAO stories: the recall rate of 100% for participants who were asked to memorize 1 or 2 PAO stories is significantly better than that for 4 PAO stories. These findings yield concrete advice for improving constructions of password management schemes and future user studies.},
bibtype = {inProceedings},
author = {Blocki, Jeremiah and Komanduri, Saranga and Cranor, Lorrie F and Datta, Anupam},
booktitle = {Proceedings of the Network and Distributed Systems Security Symposium (NDSS)}
}
Downloads: 0
{"_id":"LA4v3RGuHynagyfoH","bibbaseid":"blocki-komanduri-cranor-datta-spacedrepetitionandmnemonicsenablerecallofmultiplestrongpasswords-2015","downloads":0,"creationDate":"2019-02-15T15:14:59.447Z","title":"Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords","author_short":["Blocki, J.","Komanduri, S.","Cranor, L., F.","Datta, A."],"year":2015,"bibtype":"inProceedings","biburl":null,"bibdata":{"title":"Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords","type":"inProceedings","year":"2015","identifiers":"[object Object]","keywords":"memorability,memory,passwords","websites":"http://www.internetsociety.org/doc/spaced-repetition-and-mnemonics-enable-recall-multiple-strong-passwords","month":"2","id":"0437bed1-df41-390a-abc3-dc446886554a","created":"2018-07-12T21:31:35.941Z","file_attached":false,"profile_id":"f954d000-ce94-3da6-bd26-b983145a920f","group_id":"b0b145a3-980e-3ad7-a16f-c93918c606ed","last_modified":"2018-07-12T21:31:35.941Z","read":false,"starred":false,"authored":false,"confirmed":"true","hidden":false,"citation_key":"blocki:spaced15","source_type":"inproceedings","private_publication":false,"abstract":"We report on a user study that provides evidence that spaced repetition and a specific mnemonic technique enable users to successfully recall multiple strong passwords over time. Remote research participants were asked to memorize 4 Person-Action-Object (PAO) stories where they chose a famous person from a drop-down list and were given machine-generated random action-object pairs. Users were also shown a photo of a scene and asked to imagine the PAO story taking place in the scene (e.g., Bill Gates swallowing bike on a beach). Subsequently, they were asked to recall the action-object pairs when prompted with the associated scene-person pairs following a spaced repetition schedule over a period of 100+ days. While we evaluated several spaced repetition schedules, the best results were obtained when users initially returned after 12 hours and then in 1.5x increasing intervals: 77.1% of the participants successfully recalled all 4 stories in all 9 tests over a period of 102 days. Much of the forgetting happened in the first test period (12 hours): on average 94.9% of the participants who had remembered the stories in earlier rounds successfully remembered them in subsequent rounds. These findings, coupled with recent results on naturally rehearsing password schemes, suggest that 4 PAO stories could be used to create usable and strong passwords for 14 sensitive accounts following this spaced repetition schedule, possibly with a few extra upfront rehearsals. In addition, we find statistically significant evidence that initially (8 tests over 64 days) users who were asked to memorize 4 PAO stories outperform users who are given 4 random action-object pairs, but eventually (9 tests over 128 days) the advantage is not significant. Furthermore, there is an interference effect across multiple PAO stories: the recall rate of 100% for participants who were asked to memorize 1 or 2 PAO stories is significantly better than that for 4 PAO stories. These findings yield concrete advice for improving constructions of password management schemes and future user studies.","bibtype":"inProceedings","author":"Blocki, Jeremiah and Komanduri, Saranga and Cranor, Lorrie F and Datta, Anupam","booktitle":"Proceedings of the Network and Distributed Systems Security Symposium (NDSS)","bibtex":"@inProceedings{\n title = {Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords},\n type = {inProceedings},\n year = {2015},\n identifiers = {[object Object]},\n keywords = {memorability,memory,passwords},\n websites = {http://www.internetsociety.org/doc/spaced-repetition-and-mnemonics-enable-recall-multiple-strong-passwords},\n month = {2},\n id = {0437bed1-df41-390a-abc3-dc446886554a},\n created = {2018-07-12T21:31:35.941Z},\n file_attached = {false},\n profile_id = {f954d000-ce94-3da6-bd26-b983145a920f},\n group_id = {b0b145a3-980e-3ad7-a16f-c93918c606ed},\n last_modified = {2018-07-12T21:31:35.941Z},\n read = {false},\n starred = {false},\n authored = {false},\n confirmed = {true},\n hidden = {false},\n citation_key = {blocki:spaced15},\n source_type = {inproceedings},\n private_publication = {false},\n abstract = {We report on a user study that provides evidence that spaced repetition and a specific mnemonic technique enable users to successfully recall multiple strong passwords over time. Remote research participants were asked to memorize 4 Person-Action-Object (PAO) stories where they chose a famous person from a drop-down list and were given machine-generated random action-object pairs. Users were also shown a photo of a scene and asked to imagine the PAO story taking place in the scene (e.g., Bill Gates swallowing bike on a beach). Subsequently, they were asked to recall the action-object pairs when prompted with the associated scene-person pairs following a spaced repetition schedule over a period of 100+ days. While we evaluated several spaced repetition schedules, the best results were obtained when users initially returned after 12 hours and then in 1.5x increasing intervals: 77.1% of the participants successfully recalled all 4 stories in all 9 tests over a period of 102 days. Much of the forgetting happened in the first test period (12 hours): on average 94.9% of the participants who had remembered the stories in earlier rounds successfully remembered them in subsequent rounds. These findings, coupled with recent results on naturally rehearsing password schemes, suggest that 4 PAO stories could be used to create usable and strong passwords for 14 sensitive accounts following this spaced repetition schedule, possibly with a few extra upfront rehearsals. In addition, we find statistically significant evidence that initially (8 tests over 64 days) users who were asked to memorize 4 PAO stories outperform users who are given 4 random action-object pairs, but eventually (9 tests over 128 days) the advantage is not significant. Furthermore, there is an interference effect across multiple PAO stories: the recall rate of 100% for participants who were asked to memorize 1 or 2 PAO stories is significantly better than that for 4 PAO stories. These findings yield concrete advice for improving constructions of password management schemes and future user studies.},\n bibtype = {inProceedings},\n author = {Blocki, Jeremiah and Komanduri, Saranga and Cranor, Lorrie F and Datta, Anupam},\n booktitle = {Proceedings of the Network and Distributed Systems Security Symposium (NDSS)}\n}","author_short":["Blocki, J.","Komanduri, S.","Cranor, L., F.","Datta, A."],"urls":{"Website":"http://www.internetsociety.org/doc/spaced-repetition-and-mnemonics-enable-recall-multiple-strong-passwords"},"bibbaseid":"blocki-komanduri-cranor-datta-spacedrepetitionandmnemonicsenablerecallofmultiplestrongpasswords-2015","role":"author","keyword":["memorability","memory","passwords"],"downloads":0},"search_terms":["spaced","repetition","mnemonics","enable","recall","multiple","strong","passwords","blocki","komanduri","cranor","datta"],"keywords":["memorability","memory","passwords"],"authorIDs":[]}