Hi, my name is Rosa and I will be presenting the work Understanding the Design Space of Embodied
Passwords based on Muscle Memory. I did this work together with Bart Hengeveld and Jason Alexander,
and it's part of my master thesis at the Eindhoven University of Technology.
So passwords are something which we encounter multiple times a day and we are probably all familiar with the struggle of
recalling them and coming up with enough safe ones.
Of course we have some coping strategies, such as password managers and browsers which recall them.
However they do not solve the real problem, which is why we decided to explore whether we could come up with a password which we can recall and with
a low cognitive load. In order to do so we were inspired by embodied interaction, muscle memory,
and alternative passwords. There are already some examples out there, such as Bend Passes
and Tangible Rubic, which use muscle memory and which are tangible. However, these do not explore
the design of those passwords. So what movements, what shape, what interaction would make sense.
So therefore, our aim was to discover those things. In order to do so, we conducted six experiments
which we divided in three phases. First phase focused on the movement space of embodied passwords,
the second on the affordances and interaction, and the last phase on the memorability.
During the first phase we conducted two experiments, where we explored which movements
are suitable for passwords, and which aren't, and the space in which they should take place.
Based on this knowledge we created a bunch of mock-ups as you can see here:
which would elicit those movements. We tested these in small user study and
found that three could be successfully related back to the original movements,
which is why we use these in an experiment exploring how people use them and in which context.
From this experiment we learned that people prefer the twist, so the object on the left, as it reminds
them of combination lock (so they associated it with something safe) and it allowed them a variety
of movements. Based on this, we decided to use the twist as our basic shape and we used the interaction
which people performed with it. So people would lift the top part in order to indicate the start
of the password, rotate the movement as a password, and then press it down in order to enter it.
So having found this basic shape and interaction, the question arose to what the size should be.
In order to test this, we created a grid of the same object and used that in a user study.
Here we found that people had two preferred sizes, namely the smallest one, which was seen as the safest,
and the middle sized one, as it was ergonomically the most pleasing. Based on this finding we decided to
use both artifacts for our memorability experiment, to see whether there would be a difference.
So for our memorability experiment we asked 14 people to create two of alphanumeric passwords
and two embodied passwords (one for each artifact), for their online banking.
They also received a login screen, where they could see whether the login was successful or not.
In total we had three sessions and the experiment lasted for a week.
From this we learned that people could recall the embodied passwords for at least a week, there was no difference in the size and recalling.
Besides, all the movements created were unique. However, people did tend to stay in the range of their wrist.
Furthermore, people had different techniques to come up and recall their passwords,
such as a movement of which they could recall the feeling.
And regarding the experience, people thought the embodied passwords were very personal. However, they did have three concerns, namely:
the visibility, the fact that they felt easy, and they wondered whether their movements were unique.
Lastly, 12 participants stated that they wanted some kind of feedback, to inform them or add complexity.
Based on these findings, we of course have some discussion points. The first one being that our
embodied passwords didn't feel safe, as they were easy to recall and felt easy to perform.
It seems to be that a good password should feel complex and it might be that this stems from our
experience with alphanumeric passwords. We do not think making embodied passwords
complex is the way to go. Instead we think adding haptic feedback would solve some
of the concerns participants experienced. Moreover, we do believe that despite this
embodied passwords are still an option. as all movements were unique and besides that, the
grip and how people performed the password was unique. So perhaps embodied passwords should account for this as well.
Then for future directions: as this was a first explorative research, we didn't look into
the practicality of embodied passwords. This is of course very important and would be nice next steps.
And that was it. I hope you enjoyed it and please have a look at our paper for more details.