User Perceptions of Defensive Techniques Against Keystroke Timing Attacks During Password Entry

To protect the password from visual attacks, most password entry screens use a password masking scheme that displays a series of placeholder characters (e.g., dots and asterisks) instead of the actual password. Recent research has however shown the security provided by this form of password masking to be weak against keystroke timing-analytics attacks. The underlying idea behind these attacks is that, even when a password is masked as described above, the timing between consecutive placeholder characters gives away information about the password since the relative locations of characters on the keyboard dictate how fast fingers move between them. In this paper we argue that, for security-sensitive applications, password masking mechanisms ought to hide the true intervals between password characters in order to overcome these kinds of attacks. Making adjustments to these timings however has the potential to pose usability issues given the fact that the typing would not perfectly align with the display of typed content. The paper proposes 3 different password masking schemes and undertakes a usability evaluation on them. Our early results suggest that user receptiveness to two of the schemes is not much worse than that seen with the conventional (insecure) scheme.

• Publication year

  2021

• Venue

  CHI Extended Abstracts

• Publication date

  2021-05-08

• Fields of study

  Computer Science

• Identifiers
  DOI 10.1145/3411763.3451667
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Passquerade: Improving Error Correction of Text Passwords on Mobile Devices by using Graphic Filters for Password Masking

  2019cited by this paper
• PILOT : Password and PIN information leakage from obfuscated typing videos

  2019influential reference
• On Continuous User Authentication via Typing Behavior

  2014cited by this paper
• Examining a Large Keystroke Biometrics Dataset for Statistical-Attack Openings

  2013cited by this paper
• Using fake cursors to secure on-screen password entry

  2013cited by this paper
• Web-Based Benchmark for Keystroke Dynamics Biometric Systems: A Statistical Analysis

  2012cited by this paper
• Scikit-learn: Machine Learning in Python

  2011cited by this paper
• GREYC keystroke: A benchmark for keystroke dynamics biometric systems

  2009cited by this paper
• Vibrapass: secure authentication based on shared lies

  2009cited by this paper
• Undercover: authentication usable in front of prying eyes

  2008cited by this paper
• Design and evaluation of a shoulder-surfing resistant graphical password scheme

  2006cited by this paper
• Timing Analysis of Keystrokes and Timing Attacks on SSH

  2001cited by this paper

• No citing papers are available for this paper.