@article{
 title = {Passwords and the Evolution of Imperfect Authentication},
 type = {article},
 year = {2015},
 identifiers = {[object Object]},
 keywords = {authentication,passwords},
 pages = {78-87},
 volume = {58},
 websites = {http://cacm.acm.org/magazines/2015/7/188731-passwords-and-the-evolution-of-imperfect-authentication/fulltext},
 id = {cddb2814-62cc-37de-af04-75dd50e64908},
 created = {2018-07-12T21:31:49.626Z},
 file_attached = {false},
 profile_id = {f954d000-ce94-3da6-bd26-b983145a920f},
 group_id = {b0b145a3-980e-3ad7-a16f-c93918c606ed},
 last_modified = {2018-07-12T21:31:49.626Z},
 read = {false},
 starred = {false},
 authored = {false},
 confirmed = {true},
 hidden = {false},
 citation_key = {bonneau:passwords15},
 source_type = {article},
 notes = {Covers good story on evolution of passwords and challenges with proposed or tried alternatives for passwords. Authors also point out faults with many 'good' password advice and suggest tweaks that make the advice more usable. E.g., instead of using different password for each website, a better (and usable) advice is to use different passwords for important websites. Authors also points out that although passwords are a failed technology, it is easier to control and manage stolen/hacked user accounts than move to a new authentication technology. Websites are adding smartness to the back-end to keep number of stolen/hacked accounts in check. The smartness in back-end involves many different things including IP, browser fingerprint, the machine used to access. The authors note that authentication process is increasingly becoming complex and this complexity may case users increased confusion and distress, and may even help phishing. The authors also note that some authentications like biometrics or user-specific classifiers may break some access-control policies like sharing passwords or delegating tasks.},
 private_publication = {false},
 abstract = {Passwords have dominated human-computer authentication for 50 years despite consensus among researchers that we need something more secure and deserve something more user friendly. Much published research has focused on specific aspects of the problem that can be easily formalized but do not actually havea major influence on real-world design goals, which are never authentication per se, but rather protection of user accounts and sensitive data. As an example of this disconnect, academic research often recommends strict password-composition policies (such as length requirements and mandating digits and nonalphabetic characters) despite the lack of evidence they actually reduce harm.},
 bibtype = {article},
 author = {Bonneau, Joseph and Herley, Cormac and van Oorschot, Paul C and Stajano, Frank},
 journal = {Communications of the ACM},
 number = {7}
}

{"_id":"ERL8RC4zgdnmJDJHJ","bibbaseid":"bonneau-herley-vanoorschot-stajano-passwordsandtheevolutionofimperfectauthentication-2015","downloads":0,"creationDate":"2019-02-15T15:15:00.002Z","title":"Passwords and the Evolution of Imperfect Authentication","author_short":["Bonneau, J.","Herley, C.","van Oorschot, P., C.","Stajano, F."],"year":2015,"bibtype":"article","biburl":null,"bibdata":{"title":"Passwords and the Evolution of Imperfect Authentication","type":"article","year":"2015","identifiers":"[object Object]","keywords":"authentication,passwords","pages":"78-87","volume":"58","websites":"http://cacm.acm.org/magazines/2015/7/188731-passwords-and-the-evolution-of-imperfect-authentication/fulltext","id":"cddb2814-62cc-37de-af04-75dd50e64908","created":"2018-07-12T21:31:49.626Z","file_attached":false,"profile_id":"f954d000-ce94-3da6-bd26-b983145a920f","group_id":"b0b145a3-980e-3ad7-a16f-c93918c606ed","last_modified":"2018-07-12T21:31:49.626Z","read":false,"starred":false,"authored":false,"confirmed":"true","hidden":false,"citation_key":"bonneau:passwords15","source_type":"article","notes":"Covers good story on evolution of passwords and challenges with proposed or tried alternatives for passwords. Authors also point out faults with many 'good' password advice and suggest tweaks that make the advice more usable. E.g., instead of using different password for each website, a better (and usable) advice is to use different passwords for important websites. Authors also points out that although passwords are a failed technology, it is easier to control and manage stolen/hacked user accounts than move to a new authentication technology. Websites are adding smartness to the back-end to keep number of stolen/hacked accounts in check. The smartness in back-end involves many different things including IP, browser fingerprint, the machine used to access. The authors note that authentication process is increasingly becoming complex and this complexity may case users increased confusion and distress, and may even help phishing. The authors also note that some authentications like biometrics or user-specific classifiers may break some access-control policies like sharing passwords or delegating tasks.","private_publication":false,"abstract":"Passwords have dominated human-computer authentication for 50 years despite consensus among researchers that we need something more secure and deserve something more user friendly. Much published research has focused on specific aspects of the problem that can be easily formalized but do not actually havea major influence on real-world design goals, which are never authentication per se, but rather protection of user accounts and sensitive data. As an example of this disconnect, academic research often recommends strict password-composition policies (such as length requirements and mandating digits and nonalphabetic characters) despite the lack of evidence they actually reduce harm.","bibtype":"article","author":"Bonneau, Joseph and Herley, Cormac and van Oorschot, Paul C and Stajano, Frank","journal":"Communications of the ACM","number":"7","bibtex":"@article{\n title = {Passwords and the Evolution of Imperfect Authentication},\n type = {article},\n year = {2015},\n identifiers = {[object Object]},\n keywords = {authentication,passwords},\n pages = {78-87},\n volume = {58},\n websites = {http://cacm.acm.org/magazines/2015/7/188731-passwords-and-the-evolution-of-imperfect-authentication/fulltext},\n id = {cddb2814-62cc-37de-af04-75dd50e64908},\n created = {2018-07-12T21:31:49.626Z},\n file_attached = {false},\n profile_id = {f954d000-ce94-3da6-bd26-b983145a920f},\n group_id = {b0b145a3-980e-3ad7-a16f-c93918c606ed},\n last_modified = {2018-07-12T21:31:49.626Z},\n read = {false},\n starred = {false},\n authored = {false},\n confirmed = {true},\n hidden = {false},\n citation_key = {bonneau:passwords15},\n source_type = {article},\n notes = {Covers good story on evolution of passwords and challenges with proposed or tried alternatives for passwords. Authors also point out faults with many 'good' password advice and suggest tweaks that make the advice more usable. E.g., instead of using different password for each website, a better (and usable) advice is to use different passwords for important websites. Authors also points out that although passwords are a failed technology, it is easier to control and manage stolen/hacked user accounts than move to a new authentication technology. Websites are adding smartness to the back-end to keep number of stolen/hacked accounts in check. The smartness in back-end involves many different things including IP, browser fingerprint, the machine used to access. The authors note that authentication process is increasingly becoming complex and this complexity may case users increased confusion and distress, and may even help phishing. The authors also note that some authentications like biometrics or user-specific classifiers may break some access-control policies like sharing passwords or delegating tasks.},\n private_publication = {false},\n abstract = {Passwords have dominated human-computer authentication for 50 years despite consensus among researchers that we need something more secure and deserve something more user friendly. Much published research has focused on specific aspects of the problem that can be easily formalized but do not actually havea major influence on real-world design goals, which are never authentication per se, but rather protection of user accounts and sensitive data. As an example of this disconnect, academic research often recommends strict password-composition policies (such as length requirements and mandating digits and nonalphabetic characters) despite the lack of evidence they actually reduce harm.},\n bibtype = {article},\n author = {Bonneau, Joseph and Herley, Cormac and van Oorschot, Paul C and Stajano, Frank},\n journal = {Communications of the ACM},\n number = {7}\n}","author_short":["Bonneau, J.","Herley, C.","van Oorschot, P., C.","Stajano, F."],"urls":{"Website":"http://cacm.acm.org/magazines/2015/7/188731-passwords-and-the-evolution-of-imperfect-authentication/fulltext"},"bibbaseid":"bonneau-herley-vanoorschot-stajano-passwordsandtheevolutionofimperfectauthentication-2015","role":"author","keyword":["authentication","passwords"],"downloads":0},"search_terms":["passwords","evolution","imperfect","authentication","bonneau","herley","van oorschot","stajano"],"keywords":["authentication","passwords"],"authorIDs":[]}