Password Advice Shouldn’t Be Boring: Visualizing Password Guessing Attacks
Authors: Leah Zhang-Kennedy, Sonia Chiasson, Robert Biddle

Date: September 2013
Publication: Proceedings of the 2013 IEEE eCrime Researchers Summit (eCRS)
Page(s): 1 - 11
Publisher: IEEE
Source 1:
Source 2: - Subscription or payment required

Abstract or Summary:
Users are susceptible to password guessing attacks when they create weak passwords. Despite an abundance of text-based password advice, it appears insufficient to help home users create strong memorable passwords. We propose that users would be empowered to make better password choices if they understood how password guessing attacks work through visual communication. We created three infographic posters and an online educational comic to help users to learn about the threats. We conducted two studies to assess their effectiveness. All four methods led to superior learning outcomes than the text-alone approach. Our pre-test questionnaires also highlighted that users' understanding of password guessing attacks is limited to a “target” mental model. One week after viewing our materials, the majority of users created strong sample passwords, and correctly described all three attacks: targeted, dictionary, and brute-force.

Do you have additional information to contribute regarding this research paper? If so, please email with the details.

<-- Back to Authentication Research Paper Index

[Home] [About Us] [News] [Research]

Copyright © 2019