Long Passphrases: Potentials and Limits

TL;DR

This paper investigates the potential of long passphrases as a secure and memorable alternative to passwords, analyzing user behavior and security implications through a 39-day study.

Contribution

It introduces policies and guidelines for creating long passphrases and evaluates their usability and security in a real-world user study.

Findings

Policies support reasonable usability.

Long passphrases can offer promising security.

Common pitfalls exist in free-form passphrase creation.

Abstract

Passphrases offer an alternative to traditional passwords which aim to be stronger and more memorable. However, users tend to choose short passphrases with predictable patterns that may reduce the security they offer. To explore the potential of long passphrases, we formulate a set of passphrase policies and guidelines aimed at supporting their creation and use. Through a 39-day user study we analyze the usability and security of passphrases generated using our policies and guidelines. Our analysis indicates these policies lead to reasonable usability and promising security for some use cases, and that there are some common pitfalls in free-form passphrase creation. Our results suggest that our policies can support the use of long passphrases.