Computing Science. Determining User Passwords From Partial Information.

摘要

Memorable words have become a common technique in online banking security as a second authentication factor that is partially resistant to observation by adversaries. We formally model this technique and analyze the expected number of observations until the memorable word is known, for a range of common word lengths. We also calculate the probability of an adversary successfully passing authentication with knowledge of some but not all characters from the memorable word.