Hello, I am N’Godjigui Junior and I am presenting our late breaking work on simple yet secure
alternatives to conventional password entry methods.
As you know, conventional password entry-methods are ubiquitous, we use them every day and every time
They are popular for good reasons
as they strike the right balance between security and usability.
They protect our passwords from onlookers by masking with generic on-screen placeholders,
while offering some usability, since these characters signal that our input
was received
At a high level, our threat model applies to text-based password entry on desktops,
where an attacker may only use recorded on-screen visual information
An example is a user entering their password, say while sharing their screen during a Microsoft
Teams call.
The attacker does not see the user’s keyboard but sees when on-screen characters appear
Recent research shows a vulnerability in this situation because of DDT, which stands for
down-down time
These attacks use keystroke timing analytics including information like the location of
keys on common keyboards, the time interval
between masking characters appearing on screen, and so on to reduce the brute force search
space
For example, given that the time interval for the first two placeholders in the picture
was 250ms,
the attacker can use pre-existing keystroke timing datasets to exclude digraphs
like MO, or ON but include digraphs like LA in the list
of possible digraphs for which these placeholders appeared
Given the scenario, our requirement was to remove visual cues to ensure better security,
while changing the least usual text-based password entry methods
in order to maintain usability
As a result, we explored three defensive approaches as an alternative to the usual password entry method.
The first defense completely removes visual cues and does not show any character when
users enter their passwords The second and third approaches are similar
because they disrupt the timing information as opposed to removing them.
In the second approach, we force the characters to appear with a 250 ms minimum DDT
and in the third approach,
we use a personalized DDT as display rate, which we derive from info
like the user’s average typing speed.
The image shows the second defense, where we are forcing a DDT of 250 ms.
For the same password, the image on top shows the usual entry method where the display rate closely follows the DDT
whereas for the standardized defense, the masking characters appear only after 250ms from when the last
character appeared.
To evaluate usability, we built a simple website implementing the three approaches plus the
usual password entry method 18 college students participated over 8 days.
There were 11 majors represented.
We collected quantitative information such as typing speed, number of errors, and a usability
rating in a 7-point likert scale
Each participant was randomly assigned a password that they kept throughout the sessions.
Each session randomized the order of the defensive methods and the usual password entry.
To evaluate the security of the defense mechanisms, we replicated part of the machine
learning based attack in the paper where the DDT-based attack was studied
On Usability, Participants were not generally opposed to
the defensive methods except for method #1, where we removed all visual cues
In addition, defense 1 led to more errors and retries
Overall, defense #2b was the second most usable for the users
The graph on the right shows the rated usability from participants over the 8 sessions
and as we can see, defense #2a followed closely and defense #1 was last.
On Security, our results confirm that changing the timing information made the attack less
effective and, as the graph shows, the average attempts before guessing kept increasing as
we increased the minimum DDT threshold.
In Conclusion, we’ve seen how defense #2b seemed to be a viable option for many.
An interesting point to note is that the usability for all approaches,
kept increasing as some of the quotes below show.
We’ve also shown that altering the timing information was enough to weaken the attack.
Organizations may use different defenses per user segments and security requirements
We encourage you to read the paper and learn more about our work.
Thank you for your time.