@inproceedings{c9959b4de1c64f1b8d7daba4bd4e3815,
title = "Surpass: System-initiated user-replaceable passwords",
abstract = "System-generated random passwords have maximum password security and are highly resistant to guessing attacks. However, few systems use such passwords because they are difficult to remember. In this paper, we propose a systeminitiated password scheme called {"}Surpass{"} that lets users replace few characters in a random password to make it more memorable. We conducted a large-scale online study to evaluate the usability and security of four Surpass policies, varying the number of character replacements allowed from 1 to 4 in randomly-generated 8-character passwords. The study results suggest that some Surpass policies (with 3 and 4 character replacements) outperform by 11\% to 13\% the original randomly-generated password policy in memorability, while showing a small increase in the percentage of cracked passwords. When compared to a user-generated password complexity policy (that mandates the use of numbers, symbols, and uppercase letters) the Surpass policy with 4-character replacements did not show statistically significant inferiority in memorability. Our qualitative lab study showed similar trends. This Surpass policy demonstrated significant superiority in security though, with 21\% fewer cracked passwords than the user-generated password policy.",
keywords = "Passwords, Policy, Security, Usability",
author = "Huh, \{Jun Ho\} and Seongyeol Oh and Hyoungshick Kim and Konstantin Beznosov and Apurva Mohan and Rajagopalan, \{S. Raj\}",
year = "2015",
month = oct,
day = "12",
doi = "10.1145/2810103.2813622",
language = "English",
series = "Proceedings of the ACM Conference on Computer and Communications Security",
publisher = "Association for Computing Machinery",
pages = "170--181",
booktitle = "CCS 2015 - Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security",
note = "22nd ACM SIGSAC Conference on Computer and Communications Security, CCS 2015 ; Conference date: 12-10-2015 Through 16-10-2015",
}