PassCue: The Shared Cues System in Practice

Abstract

Shared Cues is a password management system proposed by Blocki, Blum and Datta at Asiacrypt 2013. Unlike the majority of password management systems Shared Cues passwords are never stored, even on the management device. The idea of the Shared Cues system is to help users choose and remember passwords in a manner proven to avoid brute force searching under reasonable assumptions.

Blocki et al. analysed Shared Cues theoretically but did not describe any practical tests. We report on the design and implementation of an iOS application based on Shared Cues, which we call PassCue. This enables us to consider the practicality of Shared Cues in the real world and address important issues of user interface, parameter choices and applicability on popular web sites. PassCue demonstrates that the Shared Cues password management system is useable and secure in practice as well as in theory.

A PassCue

The public pictures in the following example figures are taken by the author and used with persons’ permission. The private action and objects pictures are used with permission from morguefile.com.

Figure 3 shows the application screens for the initialization process. The initialization process is only required the first time the application is launched. The user selects a background image and a person image for the nine required cues. The user is able to select pictures from the photo library or downloaded images. When the user pushes the Select Background Image button, an image picker screen is displayed and the user can select the appropriate picture. The user can quit the application in order to obtain the images or take the images with the camera on the phone. The cue pictures are saved within the document directory in the application, and the path is saved in the database. If the images were to be deleted from the photo library, it will not affect the application. In this example the user selects a picture of the trampoline in his garden and a picture of his grandmother as the first cue.

Fig. 3.

Select cue images

When the user has selected images for all nine cues the top left screen in Fig. 4 is displayed. The user can add an account by pushing the + button. The user must select an account name and write account notes if desired. As we saw in Sect. 2.3, many sites puts restrictions on the password selection in order to force the user to select a strong password. In this case, for the Gmail account, Google recommends using a mix of letters, numbers and symbols in the password [13]. The user inputs “23&.” in the account notes field, and will use this when deriving the password. The account notes are displayed in plaintext and are assumed to be accessible to an attacker. How this affects the security is explained in Sect. 5.2.

Fig. 4.

Create new account

When the Next button is pushed, the first cue and the randomly selected association is displayed. In the example in Fig. 4 the user must imagine the following setting; “My grandmother is surfing a banana on the trampoline”. Surfing and banana is the private part of the cue and will never be displayed after the cue initialization. Surfing and banana will be used to create the password. The public picture of the user’s grandmother and his trampoline will later be used to trigger the association of surfing and banana from the users associative memory. In cue two the user must reflect over the following story; “My mother is presenting a dog on the toilet”. Cue three gives the following story; “My father is drawing a bunny in the garden”. In cue four the user must imagine the following; “My sister is inspecting a gift in the hallway”.

Once the user presses the Done button in part 4, a warning message alerts the user that the associations are non-retrievable after this step. A rehearsal schedule is created for cue 1, 2, 3 and 4. This is performed to ensure that the user does not forget the actions and objects associated with the cues.

Figure 5 shows how PassCue can be used to log in to a system. In this example, PassCue holds two accounts, Gmail and PayPal. To log in to the Gmail account, the user selects the Gmail account and the account cues and notes are displayed. The user will use the cues in order to retrieve the associations from associative memory. The user must ask himself; “What did my grandmother on the trampoline?” and should remember that she was indeed “surfing a banana!”. The next cue retrieves the association presenting and dog. Cue three reveals that “My father was drawing a bunny in the garden”. The last cue was “My sister is inspecting a gift in the hallway”.

Fig. 5.

Log in to Gmail and PayPal

In this example the user always uses the account notes as the first part of the password, and uses the three first letters from each action and object with capital first letter for all the action derived letters. The password for Gmail will be “23&.SurbanPredogDrabunInsgif”. The user must press the LoggedIn button for the rehearsal schedule to be updated. Once pressed LoggedIn the application calculates a new rehearsal time for the involved cues according to the rehearsal schedule.