{"id":6386,"date":"2014-10-20T12:30:13","date_gmt":"2014-10-20T16:30:13","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=6386"},"modified":"2020-02-26T10:56:45","modified_gmt":"2020-02-26T15:56:45","slug":"remember-strong-passwords","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/remember-strong-passwords\/6386\/","title":{"rendered":"How to Remember Strong, Unique Passwords"},"content":{"rendered":"

It\u2019s 2014. Lockheed Martin recently announced that it is making real progress towards developing a compact nuclear fusion reactor capable of providing unimaginably vast supplies of energy, in exchange for a couple handfuls of clean, somewhat easily available fuel. And yet, we\u2019re still stuck memorizing ever-longer lists of passwords<\/a> like it\u2019s 1999. If we\u2019re going to rely on an ancient authenticator for future technology, then we might as well come up with a solid way to remember our passwords. This is exactly what our friends at Carnegie Mellon<\/a> University\u2019s computer science department have done.<\/p>\n

Unfortunately, it turns out that remembering long lists of complicated passwords<\/a> requires us to do something that no one likes: study. According to research developed by Jeremiah Blocki, Saranga Komanduri, Lorrie Cranor and Anupam Datta, a system of spaced repetition paired with mnemonics, increases the likelihood that users will remember their passwords over long periods of time.<\/p>\n

The password construction element of this reminds us of the following XKCD comic about password strength<\/a>, which is to say, think sentences rather than words with leetspeak<\/a>.<\/p>\n

\"password_strength\"<\/a><\/p>\n

The participants in the Carnegie Mellon study were made to choose a person from a drop down menu that would be assigned with machine-generated random action and object pair. This method is known as a person-action-object (PAO) story. So you get something like this:\u201dMaster Yoda dropping a microphone.\u201d<\/p>\n

The mnemonic device at play here is that the participants in the study were also shown a picture of a setting in which to imagine their person-action-object story occurring. Let\u2019s say that the picture associated with our story is of an underwater laboratory. In this way we end up with a sentence like \u201cMaster Yoda dropping a microphone in an underwater laboratory\u201d.<\/p>\n

So you have six words and the password you can construct from these words is strong enough \u2014you can make sure at our Secure Password Check page<\/a>. The point of the mnemonic technique is that you don\u2019t have to remember the entire sentence.<\/p>\n

In this study, participants were prompted with a scene and person pair (Master Yoda in an underwater laboratory) and were made to perform a rehearsal routine to recall the action and the object at a set number of spaced intervals over a period of 100 or so days. The specific intervals for these rehearsal rituals, and the number of passwords (either one, two or four) a given user was expected to recall, varied from one trial group to the next.<\/p>\n

The users with the best results were those that initially rehearsed after 12 hours and then in 12\u00d71.5 hour increasing intervals (0.5 days, 1.75 days, 4.15 days, 8.15 days, 14.65 days, 24.65 days, 40.65 days, 64.65 days and 101.65 days). In that group, 77.1 percent of the participants successfully recalled all 4 stories in 9 tests over a period of 102 days.<\/p>\n

\u201cI suppose you could say that I was a little bit surprised. If you had forced me to guess which condition would yield the best results before the study, I probably would have guessed the 30minX2, though I would not have been entirely confident.\u201d<\/div>\n

I reached out to Blocki and asked if he was surprised by the results.<\/p>\n

\u201cI suppose you could say that I was a little bit surprised,\u201dhe said. \u201cIf you had forced me to guess which condition would yield the best results before the study, I probably would have guessed the 30minX2, though I would not have been entirely confident. Yes, the 12hrX1.5 group had a longer initial rehearsal interval. However, the intervals between successive rehearsals did not increase quite as quickly as they did in the 30minX2 condition. The results indicate that the spacing of rehearsals is significant (not just the total number of prior rehearsals).\u201d<\/p>\n

Incidentally, most of the forgetting happened in that first 12-hour period. Some 94.9 percent of participants who remembered stories in the early rounds, continued to remember them in subsequent rounds. Not surprisingly, the recall rate for participants asked to remember one or two stories was substantially better than those that were asked to remember four stories.<\/p>\n

Remembering long lists of #passwords require us to do something we all hate: study.<\/p>Tweet<\/a><\/blockquote>\n

There is a lot going on in this study, titled \u201cSpaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords<\/a>,\u201d[PDF]. Feel free to wade through it on your own, but be warned, there are a lot of spooky math problems going on in there.<\/p>\n

So what did we learn today? First of all we learned it\u2019s easier to remember fewer passwords. Which is probably why nearly everyone uses the same password across multiple accounts, despite knowing that password sharing is a bad idea. In other words, passwords remain desperately flawed.<\/p>\n

http:\/\/instagram.com\/p\/ubLd60P0Lv\/<\/p>\n

But there is also good news \u2014you can improve your passwords using the relatively easy mnemonic technique:<\/p>\n