Alice in Passivaseland：评估系统密码短语中熟悉词汇的可解释性
Alice in Passphraseland: Assessing the Memorability of Familiar Vocabularies for System-Assigned Passphrases
摘要：
基于文本的秘密仍然是信息系统中最常用的认证机制。IT经理在制定密码策略时必须在安全性和记忆性之间取得平衡。密码短语最初是作为人们可以回忆起的更安全的身份验证密钥引入的，它是由多个单词组成的密码。然而，当留给用户选择时，他们倾向于在密码短语中选择可预测的自然语言模式，从而导致容易受到猜测攻击。系统分配的身份验证密钥可以保证是安全的，但这是以可记忆性为代价的。在这项研究中，我们调查的记忆系统分配的密码短语从熟悉的词汇用户。密码短语是使用生成式预训练Transformer 2（GPT-2）模型生成的，该模型在熟悉的词汇表上进行训练，并且是可读的、可发音的、类似于自然英语句子的句子式密码短语。通过对Amazon Mechanical Turk上500名参与者的在线用户研究，我们测试了我们的假设-按照间隔重复时间表，基于熟悉词汇的自然英语句子密码短语比随机常见单词组成的密码短语更容易回忆。作为概念验证，我们通过Amazon Mechanical Turk参与者测试了这个想法，根据他们熟悉的故事为他们分配GPT-2生成的密码短语。与预期相反，按照间隔重复时间表，基于熟悉词汇的自然英语句子的密码短语与基于随机常用词的系统分配的密码短语的表现类似。
英文摘要：
Text-based secrets are still the most commonly used authentication mechanism in information systems. IT managers must strike a balance between security and memorability while developing password policies. Initially introduced as more secure authentication keys that people could recall, passphrases are passwords consisting of multiple words. However, when left to the choice of users, they tend to choose predictable natural language patterns in passphrases, resulting in vulnerability to guessing attacks. System-assigned authentication keys can be guaranteed to be secure, but this comes at a cost to memorability. In this study we investigate the memorability of system-assigned passphrases from a familiar vocabulary to the user. The passphrases are generated with the Generative Pre-trained Transformer 2 (GPT-2) model trained on the familiar vocabulary and are readable, pronounceable, sentence like passphrases resembling natural English sentences. Through an online user study with 500 participants on Amazon Mechanical Turk, we test our hypothesis - following a spaced repetition schedule, passphrases as natural English sentences, based on familiar vocabulary are easier to recall than passphrases composed of random common words. As a proof-of-concept, we tested the idea with Amazon Mechanical Turk participants by assigning them GPT-2 generated passphrases based on stories they were familiar with. Contrary to expectations, following a spaced repetition schedule, passphrases as natural English sentences, based on familiar vocabulary performed similarly to system-assigned passphrases based on random common words.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
