It's no secret Measuring the security and reliability of authentication via 'secret' questions

被引：71

作者：

Schechter, Stuart

Brush, A. J. Bernheim

Egelman, Serge

机构：

来源：

PROCEEDINGS OF THE 2009 30TH IEEE SYMPOSIUM ON SECURITY AND PRIVACY | 2009年

关键词：

D O I：

10.1109/SP.2009.11

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

All four of the most popular webmail providers - AOL, Google, Microsoft, and Yahoo! - rely on personal questions as the secondary authentication secrets used to reset account passwords. The security of these questions has received limited formal scrutiny, almost all of which predates webmail. We ran a user stud), to measure the reliability and security of the questions used by all four webmail providers. We asked participants to answer these questions and then asked their acquaintances to guess their answers. Acquaintances with whom participants reported being unwilling to share their webmail passwords were able to guess 17% of their answers. Participants forgot 20% of their own answers within six months. What's more, 13% of answers could be guessed within five attempts by guessing the most popular answers of other participants, though this weakness is partially attributable to the geographic homogeneity of our participant pool.

引用

页码：375 / 390

页数：16

共 17 条

[11]

RABKIN A, 2008, SOUPS 08, P13

[12]

SCHECHTER S, 2009, CHI 09

[13] The Emperor's New Security Indicators - An evaluation of website authentication and the effect of role playing on usability studies [J].

Schechter, Stuart E. ;

Dhamija, Rachna ;

Ozment, Andy ;

Fischer, Ian .

2007 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, PROCEEDINGS, 2007, :51-+

[14]

STROSS R, 2008, NY TIMES 1004

[15]

SULLIVAN B, 2008, MSNBC RED TAPE 0826

[16]

TOOMIM M, 2008, CHI 08

[17]

ZVIRAN M, 1990, JCIT, P137

← 1 2 →