Paper Info
Title
Linguistic properties of multi-word passphrases
Abstract
We examine patterns of human choice in a passphrase-based authentication system deployed by Amazon, a large online merchant. We tested the availability of a large corpus of over 100,000 possible phrases at Amazon's registration page, which prohibits using any phrase already registered by another user. A number of large, readily-available lists such as movie and book titles prove effective in guessing attacks, suggesting that passphrases are vulnerable to dictionary attacks like all schemes involving human choice. Extending our analysis with natural language phrases extracted from linguistic corpora, we find that phrase selection is far from random, with users strongly preferring simple noun bigrams which are common in natural language. The distribution of chosen passphrases is less skewed than the distribution of bigrams in English text, indicating that some users have attempted to choose phrases randomly. Still, the distribution of bigrams in natural language is not nearly random enough to resist offline guessing, nor are longer three- or four-word phrases for which we see rapidly diminishing returns.
Year
DOI
Venue
2012
10.1007/978-3-642-34638-5_1
Financial Cryptography Workshops
Keywords
Field
DocType
multi-word passphrases,natural language phrase,human choice,phrase selection,linguistic property,four-word phrase,large online merchant,possible phrase,chosen passphrases,natural language,large corpus,simple noun bigrams
Computer science,Computer security,Noun,Phrase,Natural language processing,Artificial intelligence,Bigram,Dictionary attack,Natural language,Passphrase,Linguistics,Pointwise mutual information,Proper noun
Conference
Citations 
PageRank 
References 
15
0.74
17
Authors
2
Name
Order
Citations
PageRank
Joseph Bonneau1179292.19
Ekaterina Shutova222821.51