Personal choice and challenge questions: a security and usability assessment

ABSTRACT

Challenge questions are an increasingly important part of mainstream authentication solutions, yet there are few published studies concerning their usability or security. This paper reports on an experimental investigation into user-chosen questions. We collected questions from a large cohort of students, in a way that encouraged participants to give realistic data. The questions allow us to consider possible modes of attack and to judge the relative effort needed to crack a question, according to an innovative model of the knowledge of the attacker. Using this model, we found that many participants were likely to have chosen questions with low entropy answers, yet they believed that their challenge questions would resist attacks from a stranger. Though by asking multiple questions, we are able to show a marked improvement in security for most users. In a second stage of our experiment, we applied existing metrics to measure the usability of the questions and answers. Despite having youthful memories and choosing their own questions, users made errors more frequently than desirable.

REFERENCES

• 1: F. Asgharpour, M. Jakobsson, "Adaptive Challenge Questions Algorithm in Password Reset/Recovery," in First International Workshop on Security for Spontaneous Interaction (IWIISI '07), Innsbruck, Austria, (2007).
• 2: J. Bonneau, "Alice and Bob in Love: Cryptographic Communication Using Natural Entropy," to appear in Proceedings of the 17th International Workshop on Security Protocols 2009, Cambridge, UK, April 2009.
• 3: Carl Ellison , Chris Hall , Randy Milbert , Bruce Schneier, Protecting secret keys with personal entropy, Future Generation Computer Systems, v.16 n.4, p.311-318, Feb. 2000 [doi>10.1016/S0167-739X(99)00055-2]
• 4: Dinei Florencio , Cormac Herley, A large-scale study of web password habits, Proceedings of the 16th international conference on World Wide Web, May 08-12, 2007, Banff, Alberta, Canada [doi>10.1145/1242572.1242661]
• 5: Niklas Frykholm , Ari Juels, Error-tolerant password recovery, Proceedings of the 8th ACM conference on Computer and Communications Security, November 05-08, 2001, Philadelphia, PA, USA [doi>10.1145/501983.501985]
• 6: V. Griffith, M. Jakobsson, "Messin' with Texas, Deriving Mother's Maiden Names Using Public Records," RSA CryptoBytes, <b>8(1)</b>, (2007), 18--28.
• 7: William J. Haga , Moshe Zviran, Question-and-answer passwords: an empirical evaluation, Information Systems, v.16 n.3, p.335-343, 1991 [doi>10.1016/0306-4379(91)90005-T]
• 8: Markus Jakobsson , Erik Stolterman , Susanne Wetzel , Liu Yang, Love and authentication, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357087]
• 9: Mike Just, On the Design of Challenge Question Systems, IEEE Security and Privacy, v.2 n.5, p.32-39, September 2004 [doi>10.1109/MSP.2004.80]
• 10: M. Just, "Designing Authentication Systems with Challenge Questions," in Designing Secure Systems that People Can Use, O'Reilly, L. Faith-Cranor, S. Garfinkel, editors, (2005).
• 11: M. Just, D. Aspinall, "Challenging Challenge Questions," presented at Trust 2009: International Conference on the Technical and Socio-Economic Aspects of Trusted Computing, 2009. (Available at {12})
• 12: Knowledge-Based Authentication Project Site. http://homepages.inf.ed.ac.uk/mjust/KBA.html
• 13: National Institute of Standards and Technology (NIST), "Recommendation for Key Management - Part 1: General (Revised)," NIST Special Publication 800-57, March 2007. http://csrc.nist.gov/groups/ST/toolkit/documents/SP800-57Part1_3-8-07.pdf
• 14: National Institute of Standards and Technology (NIST), "Electronic Authentication Guideline," NIST Special Publication 800-63, Version 1.0.2, April 2006. http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf
• 15: L. O'Gorman, S. Begga, J. Bentley, "Call Center Customer Verification by Query-Directed Passwords," in Proceedings of Financial Cryptography '04, International Financial Cryptography Association, (2004).
• 16: R. Pond, J. Podd, J. Bunnell, R. Henderson, "Word Association Computer Passwords: The Effect of Formulation Techniques on Recall and Guessing Rates," Computers and Security, <b>19(7)</b>, (2000), 645--656.
• 17: Ariel Rabkin, Personal knowledge questions for fallback authentication: security questions in the era of Facebook, Proceedings of the 4th symposium on Usable privacy and security, July 23-25, 2008, Pittsburgh, Pennsylvania [doi>10.1145/1408664.1408667]
• 18: Stuart Schechter , A. J. Bernheim Brush , Serge Egelman, It's No Secret. Measuring the Security and Reliability of Authentication via "Secret” Questions, Proceedings of the 2009 30th IEEE Symposium on Security and Privacy, p.375-390, May 17-20, 2009 [doi>10.1109/SP.2009.11]
• 19: C. E. Shannon, A mathematical theory of communication. Bell System Technical Journal, 1948, vol. 27, pp. 379--423.
• 20: Yishay Spector , Jacob Ginzberg, Pass-sentence—a new approach to computer code, Computers and Security, v.13 n.2, p.145-160, April 1994 [doi>10.1016/0167-4048(94)90064-7]
• 21: H. Thompson, "How I Stole Someone's Identity", Scientific American, online feature posted August 18, 2008. Retrieved from http://www.sciam.com/article.cfm?id=anatomy-of-a-social-hack, 23rd February 2009.
• 22: Michael Toomim , Xianhang Zhang , James Fogarty , James A. Landay, Access control by testing for shared knowledge, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357086]
• 23: U.S. Census Bureau, 1990 Census - Names, available at http://www.census.gov/genealogy/names/names_files.html.
• 24: U.S. Census Bureau, Frequently Occurring Surnames from Census 2000, available at http://www.census.gov/genealogy/www/freqnames2k.html.
• 25: M. Zviran, W. Haga, "A Comparison of Password Techniques for Multilivel Authentication Mechanisms," The Computer Journal, <b>36(3)</b>, (1993), 227--237.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce

General Terms:
Human Factors, Security

Keywords:
authentication, challenge questions, security, usability