Usable Authentication Research with the MVP Framework

Robert BiddleCarleton University, Ottawahttp://hotsoft.carleton.ca

Sonia Chiasson, Chris Deschamps, Elizabeth Stobert, Max Hlywa, Nick Wright, Bruna Machado Freitas, Alain Forget,

Andrew Patrick

Biddle: MVP 1

Agenda

• Usable Security and Authentication• MVP Framework• MVP Authentication Schemes• MVP Management• MVP Recent Research Results• Dalhousie Action Items

• References:– Graphical Passwords: Learning from first 12 years– The MVP Framework Web-Based Framework– http://hotsoft.carleton.ca/~sonia/wordpress/publications/

Biddle: MVP 2

Usable Security• Saltzer and Schroeder, 1975:

“It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly. Also, to the extent that the user’s mental image of his protection goals matches the mechanisms he must use, mistakes will be minimized. If he must translate his image of his protection needs into a radically different specification language, he will make errors.”

• Cranor and Garfinkel, 2005:

“secure systems that people can use.”

Biddle 3

Usable Security Challenges

• Security is a Secondary Task– Avoided or evaded if inconvenient

• Security has the “Barn Door” Property– Brief exposure can cause permanent damage

• Security has a complex language– Encryption, public/private keys, phishing, …

• Security is poorly understood by users– Users do not understand consequences of

insecure actions, assume they are not at risk, underestimate attackers’ abilities

Biddle 4

Research Methods

• Human Factors Principles• Usability Evaluation Methods• Experiment and Field Study Design• Ethical Procedures for Human

Participants• Quantitative Analysis and Statistical

Inference• Qualitative Study and Data Analysis• Reporting Results, Graphical Data

Presentation

Biddle 5

Authentication and Credentials

rosebud

6Biddle

Threats to PasswordsThreats to Passwords

• Guessing– Online (Web-Robots) or Offline (Access to DB) – Single-User (Targeted) of Multi-User (Any User) – Exhaustive or Dictionary

• Capture– Shoulder-Surfing (by eye or by video)– Social Engineering (incl. phishing)– Malware (keyloggers etc.)

Biddle 7

The Password Problem

• Passwords should be:–Easy to Remember, but–Difficult to Guess

• For multiple passwords!• Sometimes with rules!• Different rules for each password!• And compulsory regular changes!

Biddle: MVP 8

Theoretical Password Space

• The number of possible passwords that a scheme allows.

• Therefore, the number of passwords an attacker must guess to ensure success.

• Therefore, an expected value function for each attacker guess.

• IF all passwords are equally likely.

Biddle: MVP 9

Theoretical Password Space: E.g.PassPoints Password Space

Biddle: MVP 10

Effective Password Space

• The number of passwords people are likely to actually choose.

• But it’s not one space: it’s a curve. So…

Matt Weir: reusablesec.blogspot.comBiddle: MVP 11

MVP: Multiple Versatile Passwords

• Framework for Empirical Research on Usable Knowledge-Based Authentication

• Basic idea: allow new kinds of password schemes within an ecologically valid setting

• Real sites, real usage• Passwords used in context, secondary task

Biddle: MVP 12

• Site password input redirects to MVP • MVP selects scheme based on userid• Scheme runs, logging all events• Result is rendered as text password to site

Biddle: MVP 13

MVP in Use

• Button instead of “Enter Password” field• Pop-up Window with selected Scheme

Biddle: MVP 14

MVP Schemes: Text

• Pure user-chosen text• User-chosen text with rules– Length, required chars, denied chars, etc.

• Assigned random text– Length, alphabet

• Multiple word text– Number of words, chosen or assigned, lists

Biddle: MVP 15

MVP Schemes: Recognition

• Like PassFaces– Number of panels– Images per panel– Image sets• Faces• Houses• Objects

Biddle: MVP 16

MVP Schemes: Graphical Recall

• Like Draw-a-Secret– Grid size

Biddle: MVP 17

MVP Schemes: Click-Based

• Passpoints– 5 Points on Image– Tolerance areas– Can vary:• Number of Clicks• Image Sets

Biddle: MVP 18

MVP Schemes: Click Based

• Cued-Click Points– Like Passpoints, but 1-click per image– Each click selects next image– Number of images parameter

Biddle: MVP 19

MVP Schemes: Click Based

• Persuasive Cued Click Points– Like CCP, but with random viewport

Biddle: MVP 20

MVP Schemes: Other

• 2nd gen DAS, PP, CCP, PCCP, Recognition• Text Recognition• PassTiles Family• GridSure• CYOA

• More???

Biddle: MVP 21

MVP Website Engine Plugins

• Wordpress – Blog Engine with many other plugins, e.g. voting,

eCommerce, photo-sharing etc.• phpBB– Generalizable Bulletin Board

• osCommerce– eCommerce web-store system

• Drupal– Content Management System

Biddle: MVP 22

MVP Wordpress Admin

• MVP Plugin, Registration Plugin, Timeout

Biddle: MVP 23

MVP System Management

• Control Panel– f(username, system): Scheme

• Log– Time, System, User, Mode, Event, Data

• Booking and Questionnaires• Registration and Notification• Validation and Verification• Etc.

Biddle: MVP 24

MVP Username Management• By name pattern– E.g. dal101-120 (Between Subjects Group 1)

• Campusblog: scheme=textrules, cond=alphaonly• Photos: scheme=textrules, cond=alphaonly• DailyNews: scheme=textrules, cond=alphaonly

– E.g. dal121-140 (Between Subjects Group 2)• Campusblog: scheme=recognition, cond=faces• Photos: scheme=recognition, cond=faces• DailyNews: scheme=recognition, cond=faces

– E.g. dal201-220 (Within Subjects)• Campusblog: scheme=recognition, cond=faces• Photos: scheme=textrules, cond=alphaonly• DailyNews: scheme=textassigned, cond=az09-6• Cornerstore: scheme=textrules, cond=alphaonly

• By name assignmentBiddle: MVP 25

MVP Log• Time: Timestamp to 1 second• System: Name of website• User: Username• Scheme: Scheme• Condition: subscheme• Mode: create, enter, login• Event: specific to mode• Data: specific to event

Biddle: MVP 26

MVP Sites, Schemes, Studies

Comparing Password Schemes

• Criteria:– Memorability– Entry Time– Learnability– Perception of Value– Affective Appeal

• Measurements:– How to measure each?– How to compare each?

Biddle: MVP 28

Max Hlywa: In Recognition-Based GPs, are Faces the

most Memorable Images?

Hylwa co-supervised by Andrew Patrick.

No

Also, they’re slow.

Bruna Machado Freitas:How do people really use Draw-A-Secret?

Not well.

Favour Similar SquaresFavour Simple Shapes

Favour Password Reuse Misunderstand Encoding

1 unique password 61%

2 unique passwords 18%

3 unique passwords 21%

Nick Wright:Are Text Recognition Passwords

More Memorable than Text Recall?

Wright co-supervised by Andrew Patrick.

Elizabeth Stobert: Are assigned graphical passwords memorable?

Dal Action Items• Populate sites:– http://mvp.soft.carleton.ca/dal1, dal2, dal3, dal4– Choose name, theme, content

• Choose two schemes:– With exact specifics, numbers, images etc

• Choose research plan:– Consider password space– Consider research question:

• E.g. Effect of schemes, sizes, images, etc.– Consider criteria:

• Memorability, entry time, appeal, etc.– Consider metrics:

• How to evaluate criteriaBiddle: MVP 36

Usable Authentication Research with the MVP Framework

Robert BiddleCarleton University, Ottawahttp://hotsoft.carleton.ca

Sonia Chiasson, Chris Deschamps, Elizabeth Stobert, Max Hlywa, Nick Wright, Bruna Machado Freitas, Alain Forget,

Andrew Patrick

Biddle: MVP 37