TWC: Small: Toward Pronounceable Authentication Strings

Despite rampant criticism of passwords and an abundance of alternative proposals for user authentication (e.g., biometrics), passwords are not likely to be replaced in the near future due to their ease of deployment and familiarity to users. Indeed, while a number of policies for improving password systems have emerged, the most widely adopted of these is to simply increase the size of the space from which passwords are drawn. Even so, for user-chosen secrets, these policies generally make passwords harder to remember and type, leading to user frustration. Worse, users generally fulfill these policies in predictable ways, impairing the security benefits they are intended to provide.

This project leverages linguistic expertise to develop techniques that provide memorable passwords through both user input and automated processes. Specifically, we explore the formation of pronounceable authentication strings that lead to improved system security and a decreased burden on users (by providing memorable, hint-able, easily type-able passwords that are resistant to attack). Our user-influenced, but system-generated, pronounceable strings combine source words to make lexical blends (aka portmanteaus, e.g., flamingo + mongoose -> flamongoose), or elicit user-generated blends from system-suggested semantic domains. Additionally, we examine techniques for rating pronounceability of word-like strings, allowing us to quantify pronunciation difficulty and proactively apply rigorous security analysis techniques to the space of pronounceable word-like strings. The broader significance of the work is to increase our collective understanding of the driving forces behind string pronounceability and the complex relationships involved in human and automated formation of lexical blends.