Towards an Empirical Cost Model for Mental Password Algorithms

Enka Blanchard (1) , Ted Selker (2) , Florentin Waligorski (3)

1 LORIA - ALGO - Department of Algorithms, Computation, Image and Geometry
2 Selker Design Research
3 Observatoire de Paris

Reliance on technology has diminished our use of mental computation. However, mental computation's inherent privacy features are becoming central to new research on creating more secure and usable passwords than one gets with approaches such as password managers. This work empirically studies the validity of cognitive assumptions relative to mental computation for making codes like passwords , using as a starting point password algorithms and a cost model for mental computation developed by Blum and Vempala. Through a study on 126 participants, we refute some of their model's assumptions, and introduce evidence of behaviours where human computing costs behave counter-intuitively. We also identify three empirical questions around symmetry, repeatability, and distribution of costs whose resolution would allow the development of more predictive cognitive computation models. This would then allow the efficient creation of better security algorithms.

Mots clés: Psychometrics; Password; Mental Computation; Author Keywords Psychometrics; User Study

Domaines: Interface homme-machine [cs.HC]; Sciences cognitives

Enka Blanchard, Ted Selker, Florentin Waligorski. Towards an Empirical Cost Model for Mental Password Algorithms. CHI Conference on Human Factors in Computing Systems, Apr 2020, Honolulu, United States. ⟨10.1145/3334480.3382990⟩. ⟨hal-02560611⟩