5

Is there any phycological research that appears relevant to making passwords easily forgettable under adverse circumstances? Circumstances might include when under duress, after some duration of non-usage, i.e. imprisonment, or willfully by silently rehearsing random wrong variations on its theme.

You might for example remember a series of English words using the method of loci, but later disrupt the nemonic device itself by rearranging the objects and story repeatedly.

6
  • 1
    Are you trying to find an answer to this schneier.com/blog/archives/2011/10/weird_world_war.html?
    – Steve
    Commented Dec 2, 2011 at 18:07
  • I hadn't seen that post, no, just independent curiosity, but thanks for the link. Commented Dec 2, 2011 at 18:31
  • Voted for closing. It's about memory, not security. this is like asking about programming in a boating forum (meta.stackexchange.com/questions/14470/…). Commented May 27, 2016 at 22:26
  • @QuoraFeans Memory might have implications for security.
    – Anders
    Commented May 27, 2016 at 23:13
  • Definition of phycological is the branch of botany that studies algae. Did you mean psychological? Commented May 29, 2016 at 4:47

2 Answers 2

7

We tend to remember passwords automatically and (I think for many people) using auditive memory, which makes them prone to blurting them out under duress. There has been research on other forms of passwords, such as the broad class of graphical passwords, for which a classical article is The Design and Analysis of Graphical Passwords by Jermyn, Mayer, Monrose, Reiter and Rubin at Usenix 1999.

Suo, Zhu and Owen's 2005 survey covers some developments in graphical passwords. Their survey tends to show that a graphical password scheme with sufficient entropy would require a large amount of small steps, and with most techniques presented each step is prone to being revealed under coercion.

A well-known implementation of graphical passwords is the connect-the-dot scheme used on Android phones. This particular implementation does not have much entropy and is not good against hardware attacks (such as smudge observation) anyway.

I am also reminded of an old (2000) message on the Caml mailing list about Rubberhose, an early filesystem with deniable encryption, in which Julian Assange (now better known for other works) explains how his group has been thinking of using other methods for keying such as gestures (maze walking) and simile problems. I haven't found any later publication elaborating on these musings.

A 2009 recent study by Chong and Marsden shows that gesture-based passwords, at least with the constraint of recording them on a mobile phone, are less easy to memorize than PINs. I don't know how they would fare under the different point of view that passwords may be harder to memorize if that makes them easier to forget or avoid revealing.

3

Because I am provided many passwords to systems as part of my day job but have far too good a memory for strings of numbers or letters I trained myself to forget them by mentally creating 10, 20 or more passwords whenever shown a real one and although I would type the real one I'd put as much effort into remembering the others.

It works pretty well for passwords of 6 or more characters, but not for short things like 4 digit PINs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .