My name is Jayesh Doolani and I'll be presenting our work on LociMotion: a training interface
to learn a strong random password in a single training session.
For high-value secrets such as master passwords and sysadmin accounts, passwords must be strong
and should not be written down, but this places an incredible burden on users to both generate
and remember a strong secret. LociMotion is a training interface that helps
users memorize 12-character random passwords based on the method of loci memory technique.
LociMotion has a 99% recall success rate after one day, and unlike the spaced repetition
technique, in which users need up to two weeks of training to learn a password, it works
in a single training session. The LociMotion training interface is made
up of two components: a dynamically-generated video clip and a cup-and-ball game.
Based on the method of loci memory technique, the video clip contains a virtual tour of
a house, where we pick twelve key locations -- or loci -- in and around the house. Each
of the loci is tied to a specific letter of the password. We selected 26 common objects
that visually represent the 26 letters of the English alphabet. Depending on the generated
random password, twelve of these objects would appear at the twelve loci of our virtual house.
For example, given this randomly generated password, a ball for ‘b’ would appear
above the mailbox before entering the house, a violin for ‘v’ would appear at the front
lawn, and so on. The other component of LociMotion is a cup-and-ball
game, where the user is trying to catch a falling ball by moving the cup under it. Instead
of using the arrow keys to move the cup left and right, the user must instead type a specific
chunk of the password to move the cup under the ball before it hits the ground. The game
screen is divided into four columns, each column representing a three-letter chunk of
the password. For this randomly generated password , the first column is associated
with the chunk ‘abc’, the second with the chunk ‘def’, and so on. The game has
eight levels, including two levels that serve as a mental break for the user from the memorization
process. The science behind LociMotion's long term
memory training is based on a combination of Declarative Memory, such as the ability
to recall locations or addresses, and Procedural Memory is responsible for acquiring motor
skills such as riding a bicycle or playing a musical instrument. The video clip triggers
declarative memory by using the method of loci technique, helping participants to consciously
remember the associated objects in the order of the landmarks. The cup-and-ball game, on
the other hand, leverages procedural memory acquired through repetition, practice, and
motor coordination. We conducted two user studies to evaluate
the effectiveness of LociMotion. In the first study, we examined the effectiveness
of Locimotion to help users learn a 12-character random password and recall it seven days later
compared to a control condition, in which users were left to their own devices to try
to remember the 12 random characters. We conducted a user study on MTurk with 300 participants
over two sessions: a learning session on day 1 and recall session on Day 8. 86% of the
participants in the LociMotion condition logged in successfully within five attempts, compared
to just 42% of participants in the Control condition. Participants using LociMotion needed
19 minutes and 22 seconds to learn these strong passwords as compared to 11 minutes and 54
seconds for the control. The additional time and effort that users put into LociMotion
training paid off in much higher recall rates. In the second user study, we aimed to evaluate
the effectiveness of the LociMotion training interface over a longer period of time.. To
do this, we conducted a user study on MTurk with 200 participants who learned the password
on Day 1 and did recall testing on Days 2, 5 and 19. We observed a recall rate of 99%
on Day 2, 96% on Day 5 and 81% on Day 19 . LociMotion also received a score of 74 on the System
Usability Scale, which is considered above average.
Overall, these results indicate that LociMotion, with its combination of the method of Loci
and procedural memory training, can help users memorize secure, high-value authentication
secrets such as master passwords, enterprise or admin account passwords.