Password Typos and How to Correct Them Securely (2016) [pdf]
ieee-security.org
Password Typos and How to Correct Them Securely (2016) [pdf]
1–10 of 14 posts
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#2Non-PDF version: http://ieeexplore.ieee.org/document/7546536/
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#3> "In future work, we plan to investigate whether typo-tolerance will actually serve to improve overall security. Because allowing for password typos increases login success rates in benign scenarios, it may help to make adversarial login attempts stick out. This would strengthen the signals used to detect online password attacks as used in Internet-scale authentication systems."
My initial thought was that such a system would decrease security, but the idea of increasing legitimate user login success rates is very interesting. This could also decrease the volume of password reset requests.
Of course if the user were pasting their credentials in from a password manager this feature wouldn't make any difference, but until our industry can create solutions with much less authentication friction we are likely to see users continue to do what the majority of them are used to already doing.
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#4Quite happy to see that six out of the 30 front page slots are currently PDF submissions. Few other places on the internet are as scholarly. That's no small feat given HN's size. (Was pretty surprised to discover HN is now ranked 1336 globally, 565 in the US. http://www.alexa.com/siteinfo/ycombinator.com)
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#5Dear God, please do NOT spell-correct my passwords. Ever.
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#6> "In future work, we plan to investigate whether typo-tolerance will actually serve to improve overall security. Because allowing for password typos increases login success rates in benign scenarios, it may help to make adversarial login attempts stick out. This would strengthen the signals used to detect online password attacks as used in Internet-scale authentication systems." My initial thought was that such a sy…
Another really interesting potential benefit of this work is enabling users to create longer, more complicated passwords. The idea is that if users are less encumbered by typos and small errors, they'll be able to use stronger passwords while devoting the same amount of "brain space" (so to speak) to correctly using them.
EDIT: The authors are probably too modest to tout this, so I'll do it for them: this work won "Best Student Paper" at IEEE Security and Privacy last year.
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#7Dear God, please do NOT spell-correct my passwords. Ever.
The point is if you auto-correct passwords then you vastly decrease the legitimate bad password rate... meaning you can be more aggressive about locking or flagging accounts with multiple incorrect password attempts.
Whether this would be a net win or not I don't know.
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#8Dear God, please do NOT spell-correct my passwords. Ever.
The point is if you auto-correct passwords then you vastly decrease the legitimate bad password rate... meaning you can be more aggressive about locking or flagging accounts with multiple incorrect password attempts. Whether this would be a net win or not I don't know.
You can use the "nearness" logic to decide which passwords to log then, when just the logging is a problem.
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#9> "In future work, we plan to investigate whether typo-tolerance will actually serve to improve overall security. Because allowing for password typos increases login success rates in benign scenarios, it may help to make adversarial login attempts stick out. This would strengthen the signals used to detect online password attacks as used in Internet-scale authentication systems." My initial thought was that such a sy…
What would a solution even look like with less friction than what we have now? You can hit a key shortcut, pull up a list, select the password and it's done. I personally hit one keyboard shortcut, type a few characters into a fuzzy matching narrowing list, hit enter and the password is in my clipboard (password-store + dmenu) and there are equally minimal friction GUI versions of the same.
Total blue sky it, or describe it in principle. We are basically approaching the theoretical minimum in regards to friction. We have a lot of solutions that accept large decreases in security for small improvements in ease of use in an attempt to attract users.
Users don't want these tools. It's not friction, it's a complete disinterest from users. Maybe there is some theoretical approach with less friction that would win everyone over but this analysis of what the problem is stinks of tech solutionism to me.
Re: Password Typos and How to Correct Them Securely (2016) [pdf]
#10Quite happy to see that six out of the 30 front page slots are currently PDF submissions. Few other places on the internet are as scholarly. That's no small feat given HN's size. (Was pretty surprised to discover HN is now ranked 1336 globally, 565 in the US. http://www.alexa.com/siteinfo/ycombinator.com )
Currently 1337, which seems appropriate