The Usable Security of Passwords Based on Digital Objects: From Design and Analysis to User Study
Despite all efforts, password schemes intended to deploy or encourage the use of strong passwords have largely failed. As an interesting alternative to enable users to create, maintain and use high quality passwords willingly, the authors propose Object-based Password (ObPwd), leveraging the universe of personal or personally meaningful digital content that many users now own or have access to. ObPwd converts user selected digital objects to high-entropy text passwords. Memorization of exact passwords is replaced by remembering password objects. They present the design details, variants, and usability and security analysis of ObPwd; briefly discuss (publicly available) prototype implementations in various forms on several platforms; and as a major focus, report on the results of a hybrid in-lab/at-home user study on 32 participants.