Hello everyone this is Yasmeen Abdrabou from Bundeswehr University Munich and I will be
presenting our CHI poster under the title Think Harder!
Investigating the Effect of Password Strength on Cognitive Load during Password Creation
this work is in the collaboration with the University of Glasgow
in literature, three types of cognitive load measures were introduced. First
subjective where the NASA TLX questionnaire is used as an assessment tool, secondly
physiological such as tracking pupil dilation, heart-rate variability, and galvanic skin
response. Where the changes in these measures have been
shown to correlate with different levels of cognitive load
and finally, performance measures which captures how efficiently is the user performing a given
task through mental effort and task performance scores.
In the last decades, researchers have investigated the pupillary response for different types
of tasks, where pupil dilation was found to be higher
for more challenging tasks
literature showed that pupil responses can be an indicator of the effort to understand
and process information
It was also found that the pupillary dilation was larger while readers processed a complicated
sentence compared to a simpler one
until now passwords are the most popular authentication mechanism
however, they are vulnerable to different types of attacks
for this, system administrators started employing password-composition policies to eliminate
attacks and to help their employees to create strong passwords
they also started asking them to regularly change their passwords
which decrease their productivity
literature showed that users are aware of what makes a strong password
this might suggest that putting more effort in creating a password
might be an indication that it is a strong one
and this motivated us to investigate the relation between password strength and cognitive load
inferred from eye pupil diameter
we ran a lab study where we had 15 participants 5 of them were males and 10 were females and their
age varied between 22 to 31
we used Tobii pro glasses and Lenovo laptop to capture and record participant’s pupil
diameter
for evaluation, we used the mean pupil diameter and the mean pupil diameter change, please
refer to the paper for the equations
for the study design, we used a within-subjects design where participants were asked to create
12 passwords, 6 weak and 6 strong
The order of which password they should enter was counterbalanced using a Latin Square
Participants were asked to sign a consent and demographics form
we calibrated the eye tracker using Tobii’s one-point calibration scheme
participants were advised not to reuse a password they already entered
after each password entry, we asked the participants to rate the password strength on a Likert-scale
from 1 to 5
we found that participant’s pupil diameter is wider while creating strong passwords indicating
more cognitive load
we also found that the difference is consistent across participants and repetitions and the
smallest difference is 0.03 mm
in addition, using the mean pupil diameter change
we found that participant's pupil diameter dilates while creating strong passwords and
contracts while creating weak passwords
we also noticed that after the third created strong password, participant’s pupil diameter started
decreasing. This might be due to participants finding a password strategy after their third
trial leading to decreasing the cognitive load
to conclude, in this work we investigated the relation between password creation and
cognitive load inferred from eye pupil diameter.
we ran a lab study on 15 participants using a wearable eye tracker
we asked participants to create 6 weak and 6 strong passwords
we found that passwords with different strengths affect the user’s pupil diameter, giving
an indication of user’s cognitive state
we also found that creating strong passwords leads to pupil dilation while creating weak passwords leads to pupil
contraction
we envision that our findings can be integrated in interfaces to assess password strength
without revealing the actual password to the system
it can also be used to Optimize employee’s workload for better productivity.
in addition, it can also be used to suggest alternative passwords to the user based on
their pupil diameter.
and finally suggesting verbal, visual or spatial cues to help users create unique memorable
passwords
thank you, for your attention