Passwords and the Evolution of Imperfect Authentication.¶
Bonneau, J., Herley, C., van Oorschot, P. C., & Stajano, F. (2015). Passwords and the Evolution of Imperfect Authentication. Communications of the ACM, 58(7), 78-87.
Cited by¶
1 citation across 1 artifact.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Intervention-Coupled Harm
- The four moves appear in security dress: accept (cost the productivity loss into the security budget), compensate (passwordless recovery flows that target lockout on a separate channel), switch (phishing-resistant cryptographic authentication, where the coupled harm becomes procurement cost rather than daily login friction), and combine (risk-based authentication invoking MFA only on anomalous sessions, letting a different mechanism bear part of the load).
This sourceTreats the security-usability coupling of authentication mechanisms and risk-based/alternative authentication as ways to redistribute the friction-versus-security trade-off.
Supported in partVerified against the work's full text
Supports the "combine" move: risk-based authentication that demands extra factors only when classifier confidence is low; does not frame accept/compensate/switch or endorse phishing-resistant replacement.
“additional information demanded as needed if the classifier’s confidence is low or the user attempts a particularly sensitive operation, a process called progressive authentica- tion [33]; for example, a site may ask users to confirm their identity by SMS or phone call if it notices suspicious concurrent activity on their account from geographically distant locations.”
- The four moves appear in security dress: accept (cost the productivity loss into the security budget), compensate (passwordless recovery flows that target lockout on a separate channel), switch (phishing-resistant cryptographic authentication, where the coupled harm becomes procurement cost rather than daily login friction), and combine (risk-based authentication invoking MFA only on anomalous sessions, letting a different mechanism bear part of the load).
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 1 of 1 citation: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:bd4aa1f4e01c · see in the full table