Online guessing attacks against password servers can be hard to address.Approaches that throttle or block repeated guesses on an account (e.g., three strikes type lockout rules) can be effective against depth-first attacks, but are of little help against breadth-first attacks that spread guesses very widely.At large providers with tens, or hundreds, of millions of accounts breadth-first attacks offer a way to send millions or even billions of guesses without ever triggering the depth-first defenses.The absence of labels and non-stationarity of attack traffic make it challenging to apply machine learning techniques.We show how to accurately estimate the odds that an observation x indicates that a request is malicious.Our main assumptions are that successful malicious logins are a small fraction of the total, and that the distribution of x in the legitimate traffic is stationary, or very-slowly varying.From these we show how we can estimate the ratio of bad-to-good traffic among any set of requests; how we can then identify subsets of the request data that contain least (or even no) attack traffic; how these leastattacked subsets allow us to estimate the distribution of values of x over the legitimate data, and hence calculate the odds ratio.A sensitivity analysis shows that even when we fail to identify a subset with little attack traffic our odds ratio estimates are very robust.

Practitioners who seek to defend password protected resources from online guessing attacks will find a shortage of tooling and techniques to help them. Little research suggests anything beyond blocking or throttling traffic from IP addresses sending suspicious traffic; counting failed authentication requests, or some variant, is often the sole feature used to determine suspicion. In this paper we show that several other features can greatly help distinguishing benign and attack traffic. First, we increase the penalties for clients responsible for fail events involving passwords frequently-guessed by attackers. Second, we reduce the threshold (and thus protect better) for accounts with weak passwords. Third, we detect, and are more forgiving of, login failures caused by users mistyping their passwords. Most importantly, we achieve all of these goals without needing any marker that indicates weak accounts, changing the format in which passwords are stored (i.e. we do not store passwords plaintext or in any recoverable form), or storing any information that might be harmful if leaked. We present an open-source implementation of this system and demonstrate its improvement over simpler blocking strategies in various simulated scenarios.

People sometimes require very strong passwords for high-value accounts (e.g., master passwords for password managers and encryption keys), but often cannot create these strong passwords.Assigning them provably strong secrets is one solution, and prior work has shown that people can learn these assigned secrets through rote learning, though learning the secrets takes some time and they are quickly forgotten after two weeks of disuse.To improve upon the learning speed and long-term recall of strong, assigned secrets, we introduce, implement and evaluate a set of treatments, inspired by mnemonic devices and real-time feedback tutoring systems, to assist people in learning and remembering their assigned secrets.We encoded strong secrets as a set of six words randomly chosen from a corpus of 676 (∼56 bits of entropy).In a randomized between-subjects experiment, our story mnemonic, in which participants wrote two sentences linking their assigned secret words together in a narrative, performed best.Participants who used the story mnemonic required significantly fewer training sessions (7.5 versus 12 sessions) and had higher two-week recall when allowing for minor errors (84% vs. 65%) than the rote control from prior work.Additionally, 92% of those who could not recall their full secrets after two weeks were able to recover their secret once they saw their mnemonic hints with the secret words elided.In contrast, our other treatments did not perform as well -providing few, if any, notable improvements over the rote control.Finally, in an exit survey, a large majority of our participants reported that our treatments were quick, helpful and enjoyable.

We present the Balloon algorithm for password hashing. This is the first cryptographic hash function that: (i) has proven memoryhardness properties in the random-oracle model, (ii) uses a passwordindependent access pattern, and (iii) meets—and often exceeds—the performance of the best heuristically secure password-hashing algorithms. Memory-hard functions require a large amount of working space to evaluate efficiently and, when used for password hashing, they dramatically increase the cost of offline dictionary attacks. In this work, we leverage a previously unstudied property of a certain class of graphs (“random sandwich graphs”) to analyze the memory-hardness of the Balloon algorithm. The techniques we develop are general: we also use them to give a proof of security of the scrypt and Argon2i password-hashing functions, in the random-oracle model. To motivate the need for security proofs in the area, we demonstrate a practical attack against Argon2i that successfully evaluates the function with less space than was previously claimed possible. Finally, we discuss recent important work on parallel attacks against memory-hard functions with password-independent access patterns, and we propose a defense against them. We experiment with the Balloon hashing algorithm and report on its performance relative to other claimed memory-hard functions.

We present the Balloon password-hashing algorithm. This is the first practical cryptographic hash function that: (i) has proven memory-hardness properties in the random-oracle model, (ii) uses a password-independent access pattern, and (iii) meets-and often exceeds-the performance of the best heuristically secure password-hashing algorithms. Memory-hard functions require a large amount of working space to evaluate efficiently and, when used for password hashing, they dramatically increase the cost of offline dictionary attacks. In this work, we leverage a previously unstudied property of a certain class of graphs ("random sandwich graphs") to analyze the memory-hardness of the Balloon algorithm. The techniques we develop are general: we also use them to give a proof of security of the scrypt and Argon2i password-hashing functions, in the random-oracle model. Our security analysis uses a sequential model of computation, which essentially captures attacks that run on single-core machines. Recent work shows how to use massively parallel special-purpose machines (e.g., with hundreds of cores) to attack memory-hard functions, including Balloon. We discuss these important attacks, which are outside of our adversary model, and propose practical defenses against them. To motivate the need for security proofs in the area of password hashing, we demonstrate and implement a practical attack against Argon2i that successfully evaluates the function with less space than was previously claimed possible. Finally, we use experimental results to compare the performance of the Balloon hashing algorithm to other memory-hard functions.

Nearly all smartphones and tablets support unlocking with a short user-chosen secret: e.g., a numeric PIN or a pattern. To address users' tendency to choose guessable PINs and patterns, we compare two approaches for helping users learn assigned random secrets. In one approach, built on our prior work [16], we assign users a second numeric PIN and, during each login, we require them to enter it after their chosen PIN. In a new approach, we re-arrange the digits on the keypad so that the user's chosen PIN appears on an assigned random sequence of key positions. We performed experiments with over a thousand participants to compare these two repetition-learning approaches to simple user-chosen PINs and assigned PINs that users are required to learn immediately at account set-up time. Almost all of the participants using either repetition-learning approach learned their assigned secrets quickly and could recall them three days after the study. Those using the new mapping approach were less likely to write down their secret. Surprisingly, the learning process was less time consuming for those required to enter an extra PIN.

We introduce a survey instrument for anticipating otherwise-unforeseen risks resulting from research experiments. We present experiments hypothetically, then ask: \If someone you cared about were a candidate participant for this experiment, would you want that person to be included as a participant? (Q1) and \Do you believe the researchers should be allowed to proceed with this experiment? (Q2). Having honed this approach over multiple studies, and multiple years, we have aborted proposed studies due to survey respondents’ concerns. In this paper, we test this instrument by presenting ve past (real) experiments, posed as hypotheticals, to 3,539 workers on Amazon’s Mechanical Turk. These experiments include Indiana University’s social phishing study, University of California’s ‘spamalytics’ study, and Facebook’s emotional contagion experiment. We reveal what researchers behind controversial experiments might have foreseen had our instrument been available to them prior to conducting their experiments.

To discourage the creation of predictable passwords, vulnerable to guessing attacks, we present Telepathwords. As a user creates a password, Telepathwords makes realtime predictions for the next character that user will type. While the concept is simple, making accurate predictions requires efficient algorithms to model users' behavior and to employ already-typed characters to predict subsequent ones. We first made the Telepathwords technology available to the public in late 2013 and have since served hundreds of thousands of user sessions. We ran a human-subjects experiment to compare password policies that use Telepathwords to those that rely on composition rules, comparing participants' passwords using two different password-evaluation algorithms. We found that participants create far fewer weak passwords using the Telepathwords-based policies than policies based only on character composition. Participants using Telepathwords were also more likely to report that the password feedback was helpful.

We update the ethical-response survey we published in July [9] to broaden its reach in two dimensions. In addition to surveying workers on Amazon’s Mechanical Turk, we also reached out to juror candidates who had been summoned to serve at the King County Superior Court in Seattle, WA. In addition to five experimental scenarios we examined in prior surveys, we added seven new scenarios: two designed to serve as baselines of innocuousness and concern; two censorship-detection experiments that the Internet Measurement Conference refused to publish on ethical grounds, two human-subjects experiments for which researchers requested feedback, and one experiment (by OKCupid) that received attention in the press.

We investigated how household deployment of Internet-connected locks and security cameras could impact teenagers' privacy. In interviews with 13 teenagers and 11 parents, we investigated reactions to audit logs of family members' comings and goings. All parents wanted audit logs with photographs, whereas most teenagers preferred text-only logs or no logs at all. We unpack these attitudes by examining participants' parenting philosophies, concerns, and current monitoring practices. In a follow-up online study, 19 parents configured an Internet-connected lock and camera system they thought might be deployed in their home. All 19 participants chose to monitor their children either through unrestricted access to logs or through real-time notifications of access. We discuss directions for auditing interfaces that could improve home security without impacting privacy.

Challenging the conventional wisdom that users cannot remember cryptographically-strong secrets, we test the hypothesis that users can learn randomly-assigned 56- bit codes (encoded as either 6 words or 12 characters) through spaced repetition. We asked remote research participants to perform a distractor task that required logging into a website 90 times, over up to two weeks, with a password of their choosing. After they entered their chosen password correctly we displayed a short code (4 letters or 2 words, 18.8 bits) that we required them to type. For subsequent logins we added an increasing delay prior to displaying the code, which participants could avoid by typing the code from memory. As participants learned, we added two more codes to comprise a 56.4- bit secret. Overall, 94% of participants eventually typed their entire secret from memory, learning it after a median of 36 logins. The learning component of our system added a median delay of just 6.9 s per login and a total of less than 12 minutes over an average of ten days. 88% were able to recall their codes exactly when asked at least three days later, with only 21% reporting having written their secret down. As one participant wrote with surprise, "the words are branded into my brain."

We designed and tested attractors for computer security dialogs: user-interface modifications used to draw users' attention to the most important information for making decisions. Some of these modifications were purely visual, while others temporarily inhibited potentially-dangerous behaviors to redirect users' attention to salient information. We conducted three between-subjects experiments to test the effectiveness of the attractors.

Reviewers of papers that describe human subjects experiments of security and privacy often observe that authors are prone to a set of common mistakes that, if they were aware of, could be easily avoided. In this document I provide advice to help researchers avoid these mistakes in designing, performing, and documenting their experiments.

Attackers only get better at guessing the passwords users will create under a given set of password composition constraints. They learn more about users’ password-selection behaviors each time they compromise a passsword, regardless of whether they obtain the password by breaching a password database, installing a key logger, phishing, or by guessing. Defensive analysis of user-chosen passwords could similarly identify predictable password-selection behaviors and help us to prevent users from choosing predictable passwords. Alas, attempts to perform such analysis have been stunted by requirements to encrypt passwords irreversibly and by the indignation shown for those who would try to analyze the passwords their users choose. We argue that encrypting passwords irreversibly has done more harm than good, providing a minimal short-term reduction in risk as opposed to reversible encryption, but imposing a severe cost on our ability to improve password defenses for the long term. As encrypting passwords is of little value if users continue to choose passwords that are easily guessed, our collective choice to blind ourselves to our users’ passwords has made us collectively less secure. We argue that passwords should be encrypted so as to allow for offline defensive analysis. While we believe there’s a strong case to be made that the social benefits of defensive password analysis outweigh the risks, the individual cost/benefit tradeoff discourages users and firms from contributing passwords for defensive analysis. When choosing a password, an individual may benefit from analyses based on others’ prior contributions, but does not benefit from contributing the password she chooses. However, she bears the risk should the password she has chosen is compromised as a result of contributing. This makes making free-riding on others’ password contributions the security-optimizing strategy for her as an individual. To solve this free rider problem, we propose that systems that help to prevent users from choosing weak passwords (informed by prior users’ passwords choices), require that those using the system contribute their newly-chosen passwords in return.