Grant: Discovery Grants Program - Individual

User authentication is the first line of defense for most computer systems, ranging from mobile devices to critical systems (e.g., for utilities and health care). Knowledge-based authentication systems are the most common, based on a secret that you know (e.g., passwords and passphrases). These systems typically protect our confidential information (e.g., emails and documents), finances (e.g., online banking), and even our homes (e.g., through smart home services). Knowledge-based authentication systems, particularly passwords, are widely popular due to their low-cost and lack of specialized hardware requirements. Currently, passwords are important alone or in combination with other approaches such as password managers (as the master password), biometrics (for backup authentication when legitimate users are rejected), or multi-factor authentication (e.g., with physical tokens). Unfortunately, password security has become a serious concern, due to recent advances in password attacks using publicly leaked password and personal information. These attacks call into question the viability of existing password systems and demonstrate the need for new approaches to improve security. People are frustrated with the difficulty to remember a secure password. However, to date, no new authentication proposal has been widely adopted to replace traditional text passwords. Major barriers to widespread adoption include cost, security, and usability issues (e.g., frequency of errors and memorability). This research program will design, develop, and evaluate knowledge-based authentication approaches to help users create and remember secure secrets, with a focus on usable systems that enhance memorability. Specific objectives include the development of: (a) authentication systems that harness implicit memory; and (b) authentication systems that support explicit memory. Explicit and implicit memory are differentiated by whether or not an individual is consciously aware of his/her recollection. The outcomes of this program are anticipated to help improve the security and user experience of people in a wide variety of authentication environments (e.g., mobile, web, workplace, and home). It is expected that a number of the authentication systems created through the research will undergo large-scale studies with the goal of eventual deployment. Our findings and systems we design will help Canadians (and others) protect their sensitive information in a variety of environments, including web, mobile, financial, healthcare, home, and critical systems. The research program will also investigate foundations for designing new authentication systems that empower human memory capabilities, which can be used by other researchers in the field.