This document discusses different methods for password authentication and recovery. It describes captchas as a challenge-response test to verify humans by having them type distorted text from images. It also discusses graphical passwords that use image recognition and click-based patterns. For password recovery, it explains using challenge-response pairs where users enroll questions and answers, or systems probe the user's knowledge through recent interactions or personal details. Security aspects like guessing difficulty of the answers are also covered.

1. Computer Security Management
(ISYS20261)
Lecture 14 – More on Passwords
Module Leader: Dr Xiaoqi Ma
School of Science and Technology

2. Last week …
• Passwords
• PINs
• Challenge-response
Computer Security Management
Page 2

3. Today
• Captchas
• Graphical passwords
• How to recover a forgotten password
Computer Security Management
Page 3

4. Captchas (1)
• Completely Automated Public Turing test to tell Computers and
Humans Apart (von Ahn, Blum, Hopper and Langford, 2000)
• Challenge-response test to ensure that the user is a human
– E.g. to prevent automated account harvesting
• Captcha is a computer generated puzzle, i.e. a distorted image of a
number/character sequence
• User has to type in the number/character sequence
• Most humans can read the image but current software can’t
• Examples:
Computer Security Management
Page 4

5. Captchas (2)
• Sequence: System
request
"squestra"
authenticated
• Problems:
– Blind or visually impaired users?
– Mobile devices with limited hardware capabilities?
Computer Security Management
Page 5

6. How to crack Captchas
• Human operators (“Sweatshop”)
• Forward captcha from original site onto attackers web site and let
users unwittingly solve the puzzle! (in real time)
Attacker's
System
web site
request to logon to
Attacker's 'free' site request to logon to
'protected' site
"squestra"
"squestra"
authenticated
authenticated
Computer Security Management
Page 6

7. Graphical authentication
• Human memory for images is better than for words
• New approach: graphical (image based) authentication
• Graphical passwords
– Recognition based
– User to select picture among a set of distractors
– Example: PassFaces
• Position based passwords
– Click on right region on an image (challenge)
– Chose the correct pattern
– Example: GrIDsure
Computer Security Management
Page 7

8. Password recovery
• Passwords are often forgotten
– Infrequent use
– Forced change (due to password policy)
– etc
• Password (credential) needs to be recovered
• Easy option: send me a new (or my old) password via email
• Not really secure!
• Need for authentication
• Better option: challenge-response based recovery
Computer Security Management
Page 8

9. Credential recovery
• User-triggered process to reset forgotten passwords
• Uses knowledge-based authentication
• Two varieties
– Answering enrolled challenges
– Recovery without enrolment
Computer Security Management
Page 9

10. Recovery with enrolment
• Users enrol set of challenges and responses
• On re-set they have to prove their identity by answering challenges
• Issues
– Which challenge-responses should be used?
– Who chooses them?
Computer Security Management
Page 10

11. Recovery without enrolment
• Probing knowledge shared between system and user:
– Probing recent interactions with the system, e.g. “what was last transaction?”
– Personal history, e.g. calendar entries
– Recognition of items user should be familiar with, e.g. own photo from a set of
mixed ones
Computer Security Management
Page 11

12. Security aspects of challenge-response pairs
• Guessing difficulty
– low expectation for a successful guess within a small number of attempts
– answer should come from a uniform distribution – is this realistic?
• Observation difficulty
– it should be difficult for an attacker to retrieve or observe the answer
– answers should not be available from public sources, e.g. social networking
websites
– observation difficulty will differ for individuals, e.g. family, friends, colleagues or
strangers
• Capture difficulty
– Covert recording of answers
– How many recovery attempts does an attacker have to observe in order to
launch a successful attack?
Computer Security Management
Page 12

13. Questions
• Fixed
– Administrator-chosen to Prevents choice of poor questions
• Open
– User-chosen personally memorable content
• Controlled
– Fixed set of questions but user can select and modify
– Often combined with hints
Computer Security Management
Page 13

14. Answers
• Fixed
– User chooses one answer from a set
– Common answers need to be barred!
• Open
– Free form text
• Controlled
– User-modified answer
– Format of answer is controlled
Computer Security Management
Page 14

15. Challenge-response pairs
• Fixed-controlled
• Fixed-open
• Controlled-fixed
Computer Security Management
Page 15

16. Comments
• Credential recovery systems need to be carefully planned and
designed
• Infrequent usage
– mechanism should be forgiving
– users may remember cues, but not details (e. g. word but not upper/lower
case)
• Consider cost of setting up and maintaining system
• Currently text-based, but could involve photos or music
• Can be combined with other techniques, e.g. captchas
Computer Security Management
Page 16