Revamping Password Security: Leveraging Mnemonics for Enhanced Authentication

Area of Science:

• Computer Science
• Human-Computer Interaction
• Cybersecurity

Background:

• Traditional password authentication faces challenges with increasing security demands and usability trade-offs.
• Password managers (PMs) improve usability but pose a significant risk if their vaults are compromised.
• Existing security enhancements often fail to balance robust protection with user-friendliness.

Purpose of the Study:

• To develop and evaluate a novel authentication system that augments passwords stored in password managers with a user-held secret.
• To enhance resilience against password manager vault compromise scenarios.
• To assess the feasibility and usability of mnemonic-based authentication in real-world login scenarios.

Main Methods:

• Developed Mindlock, a browser extension prototype acting as a mnemonic application interface.
• Combined password manager stored data with a user-remembered mnemonic for authentication.
• Used the stored password as a decoy to trigger alarms upon potential PM compromise.
• Conducted a user study to evaluate the system's feasibility and usability.

Main Results:

• Preliminary evidence suggests users can adopt mnemonic-based augmentation.
• The proposed method shows limited negative impact on usability during login routines.
• The decoy password mechanism can indicate potential password manager compromise.

Conclusions:

• Mnemonic-based augmentation offers a promising approach to enhance password security in the context of password manager usage.
• The system demonstrates potential for improving resilience against vault-only compromise attacks.
• Further research is needed to fully explore security implications under various threat models.