Passwords you'll never forget, but can't recall

ABSTRACT

We identify a wide range of human memory phenomena as potential certificates of identity. These "imprinting" behaviors are characterized by vast capacity for complex experiences, which can be recognized without apparent effort and yet cannot be transferred to others. They are suitable for use in near zero-knowledge protocols, which minimize the amount of secret information exposed to prying eyes while identifying an individual. We sketch several examples of such phenomena[1-3], and apply them in secure certification protocols. This provides a novel approach to human-computer interfaces, and raises new questions in several classic areas of psychology.

REFERENCES

• 1: R. N. Shepard (1967). Recognition memory for words, sentences, and pictures. J Verb Learn Verb Behav 6, 156--163.
• 2: Reber, A. S. (1967). Implicit learning of artificial grammars. Journal of Verbal Learning and Verbal Behavior 6, 855--863.
• 3: A. Salaso, R. M. Shiffrin, and T. C. Feustel (1985). Building Permanent Memory Codes: Codification and Repetition Effects in Word Identification. Journal of Experimental Psychology: General 114(1), 50--77.
• 4: L. Standing, J. Conezio, and R. N. Haber (1970). Perception and memory for pictures: single trial learning of 2500 visual stimuli. Psychol. Sci. 19, 73--74.
• 5: Cave, B. C. (1997). Very long-lasting priming in picture naming. Psychol. Sci 8, 322--325.
• 6: Perruchet, P. and Pacteau, C. (1990). Synthetic grammar learning: Implicit rule abstraction or explicit fragmentary knowledge? Journal of Experimental Psychology: General 119, 264--275.
• 7: E. Tulving, D. L. Schacter, H. A. Stark (1982). Priming effects in word-fragment completion are independent of recognition memory. Journal of Experimental Psychology: Learning, Memory & Cognition 8(4), 336--342.
• 8: G. Musen and A. Treisman (1990). Implicit and Explicit Memory for Visual Patterns. J Exp Psychol Learn Mem Cogn 16(1), 127--37.
• 9: A. Karni and D. Sagi (1993). The time course of learning a visual skill. Nature 365, 250--252.
• 10: R. Dhamija and A. Perrig (2000). Déja vu: A user study using images for authentication. In Proceedings of the 9th USENIX Security Symposium, 2000.
• 11: A press report is given at http://research.microsoft.com/displayArticle.aspx?id=417
• 12: http://www.atstake.com/research/lc
• 13: B. Rossion and G. Pourtois (2001). Revisiting Snodgrass and Vanderwart's object database: Color and Texture improve Object Recognition. Presented at VisionScienceS, Sarasota, FL, May, 2001. Abstract in Journal of Vision.
• 14: J. G. Snodgrass, and M. Vanderwart (1980). A standardized set of 260 pictures: Norms for name agreement, image agreement, familiarity, and visual complexity. Journal of Experimental Psychology: Learning, Memory & Cognition, 6:174--215.
• 15: M. Wilson (2003). MRC Psycholinguistic Database: Machine Usable Dictionary, Version 2.00. Rutherford Appleton Laboratory, Oxfordshire, England.
• 16: W. van Heuven (2003). Pseudo: a nonword/pseudoword generator. NICI, Univeristy of Nijmegen, http://www.nici.kun.nl/~heuven/.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Theory and methods

General Terms:
Security, Theory

Keywords:
adaptive interfaces, human memory, identity, passwords, security