Adams and Sasse: Password Usability Lecture

VOCABULARY flashcards based on a lecture regarding the 1999 Adams and Sasse paper 'Users are not the Enemy' and modern usable security concepts.

Communications of the ACM

A magazine aimed at general audiences and industry practitioners where the influential 1999 paper on password usability was published.

Security-memorability tension

The core finding that high password security requirements (like length and complexity) often make passwords harder to remember, leading to insecure workarounds.

FIPS (Federal Information Processing Standards)

Standardized rules mentioned in the paper regarding password composition, lifetime, and individual ownership to ensure security.

Grounded theory

A specific qualitative research methodology used to analyze data and extract meaningful categories or models from interviews and surveys.

Need-to-know principle

A military-derived concept used by organizations to withhold security information from users to prevent vulnerabilities from being revealed, effectively treating users as the enemy.

Vicious circle of lack of communication

An explanatory model where restricted information leads to low user motivation, unusable security mechanisms, and the false belief that users are inherently careless.

Mental model

A user's internal understanding of how a system works; users often apply real-world security models to computers, which can lead to mistakes like believing husband/wife names are unguessable.

Credential stuffing

A type of cyberattack where breached passwords from one service are tried across multiple other platforms to see if they work.

User-centered security

A design philosophy that advocates for security mechanisms to be designed around the needs and capabilities of the user rather than assuming they are lazy or dumb.

SSO (Single Sign-On)

An authentication mechanism recommended in the paper that allows users to access multiple applications with one set of credentials to reduce cognitive load.

MFA (Multi-Factor Authentication)

A security method requiring two or more forms of verification, such as a password and a physical token like a YubiKey.

Passkeys

A modern alternative to passwords that uses a biometric unlock (like face ID or fingerprints) and is considered more secure and phishing-resistant.

Need-to-know principle break

The author's suggestion to drop the 'need-to-know' military approach and instead treat users as informed partners to improve security behavior.

Cognitive overload

The state of having too much information or too many memory-based tasks (like remembering 50 passwords), leading to burnout or bypass behaviors.

Brute force

The practice of using automated systems to try millions of password combinations rapidly, a concept many users in the study failed to understand.