How does one make password easily forgettable?

Question

Is there any phycological research that appears relevant to making passwords easily forgettable under adverse circumstances? Circumstances might include when under duress, after some duration of non-usage, i.e. imprisonment, or willfully by silently rehearsing random wrong variations on its theme.

You might for example remember a series of English words using the method of loci, but later disrupt the nemonic device itself by rearranging the objects and story repeatedly.

Answer 1

We tend to remember passwords automatically and (I think for many people) using auditive memory, which makes them prone to blurting them out under duress. There has been research on other forms of passwords, such as the broad class of graphical passwords, for which a classical article is The Design and Analysis of Graphical Passwords by Jermyn, Mayer, Monrose, Reiter and Rubin at Usenix 1999.

Suo, Zhu and Owen's 2005 survey covers some developments in graphical passwords. Their survey tends to show that a graphical password scheme with sufficient entropy would require a large amount of small steps, and with most techniques presented each step is prone to being revealed under coercion.

A well-known implementation of graphical passwords is the connect-the-dot scheme used on Android phones. This particular implementation does not have much entropy and is not good against hardware attacks (such as smudge observation) anyway.

I am also reminded of an old (2000) message on the Caml mailing list about Rubberhose, an early filesystem with deniable encryption, in which Julian Assange (now better known for other works) explains how his group has been thinking of using other methods for keying such as gestures (maze walking) and simile problems. I haven't found any later publication elaborating on these musings.

A 2009 recent study by Chong and Marsden shows that gesture-based passwords, at least with the constraint of recording them on a mobile phone, are less easy to memorize than PINs. I don't know how they would fare under the different point of view that passwords may be harder to memorize if that makes them easier to forget or avoid revealing.

Answer 2

Because I am provided many passwords to systems as part of my day job but have far too good a memory for strings of numbers or letters I trained myself to forget them by mentally creating 10, 20 or more passwords whenever shown a real one and although I would type the real one I'd put as much effort into remembering the others.

It works pretty well for passwords of 6 or more characters, but not for short things like 4 digit PINs.