국내 사용자의 패스워드 사용 현황 분석
A Case Study of Password Usage for Domestic Users
1
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
패스워드 기반 인증 기법의 안전성 강화를 위해서는 충분한 길이와 무작위 문자열 성질을 갖는 강한 패스워드의 선택과 관리가 필요하다. 하지만 이미 알려진 바와 같이 많은 사용자들은 기억하기 쉬운 약한 패스워드를 선택하는 경향이있으며 이에 대한 관리 또한 취약하다. 본 논문에서는 국내 사용자들이 어떠한 경향으로 패스워드를 선택하며 관리하는지에 대해 연구하였다. 직접 327명 규모의 설문조사를 진행하여, 패스워드 생성과 갱신에 관한 경향을 분석하였으며 또한 패스워드의 구조와 계정관리에 관한 경향을 분석하였다. 마지막으로 서버의 패스워드 생성 규칙이 사용자 패스워드구성에 주는 영향에 대해 분석하였다. 분석 결과 사용자들이 유의하게 선호하는 패스워드 구조, 특수문자가 있는 반면서버의 패스워드 생성 규칙이 미치는 영향은 유의하지 않음을 발견하였다.
Abstract
For securing password-based authentication, a user must select and manage a strong password that has sufficient length and randomness. Unfortunately, however, it is known that many users are likely to choose easy-to-remember weak passwords and very poorly manage them. In this paper, we study a domestic user case of password selection and management. We conducted a survey on 327 domestic users and analyzed their tendency on password creation and update strategies, and also on the password structure and account management. We then analyzed an effect of a server's password creation rule on a structure of a user-chosen password. Our findings include that there are password structures and special characters that users significantly prefer while the effect of server's password creation rule is insignificant.
참고문헌 (19)
- J. Abbott, "Password differences based on language and testing of memory recall", NNGT Int J. on Information Security, 2, pp.1~6 (2015)
- J. Bonneau, "The science of guessing : analyzing an anonymized corpus of 70 million passwords", Proceedings of the 33th IEEE Symposium on Security and Privacy, pp.538~552 (2012)
- R. Chatterjee, "pASSWORD tYPOS and How to Correct Them Securely", Proceedings of the 37th IEEE Symposium on Security and Privacy, pp.799~818 (2016)
- A. Das, "The tangled web of password reuse", Proceedings of the Network and Distributed System Security Symposium (2014)
- D. Florêncio, "A Large-Scale Study of Web Password Habits", Proceedings of the 16th international conference on World Wide Web. ACM, pp.657~666 (2007)
- A. Hang, "Where Have You Been? Using Location-Based Security Questions for Fallback Authentication", Proceedings of the Symposium on Usable Privacy and Security, pp.169~183 (2015)
- N. Karapanos, "Sound-Proof : Usable Two-Factor Authentication Based on Ambient Sound", Proceedings of the 24th USENIX Security Symposium, pp.483~498 (2015)
- 김승연, "패스워드 표기 방식이 패스워드 생성에 미치는 영향", 정보보호학회논문지, 25(5), pp.1235~1243 (2015), 한국정보보호학회[DOI]
- Z. Li, "A Large-Scale Empirical Analysis of Chinese Web Passwords", Proceedings of the 23rd USENIX Security Symposium, pp.559~574 (2014)
- R. Morris, "Password security : A case history", Communications of the ACM, 22(11), pp.594~597 (1979)
- C. Rinn, "Password Creation Strategies Across High-and Low-Literacy Web Users", Proceedings of the 78th Association for Information Science and Technology, 52(1) (2015)
- R. Shay, "Encountering stronger password requirements : user attitudes and behaviors", Proceedings of the Symposium on Usable Privacy and Security, pp.243~255 (2014)
- E. Stobert, "The password life cycle : user behaviour in managing passwords", Proceedings of the Symposium on Usable Privacy and Security, pp.243~255 (2014)
- B. Ur, "I Added ‘!’ at the End to Make It Secure" : Observing Password Creation in the Lab", Proceedings of the 11th Annual Symposium on Usable Privacy and Security, pp.123~140 (2015)
- R. Veras, "On the semantic patterns of passwords and their security impact", Proceedings of the Network and Distributed System Security Symposium (2014)
- W. Wang, "A Large-scale Survey on Password Habits of Internet Users in China", Jounal of Convergence Information Technology, 8(4), pp.71~80 (2013)
- Korea Internet & Security Agency, "Password choice and using guidance", ~ (2008)
- "The reinforcement of authorized certificate rule"[URL]
- "How to Create a Secure & Memorable Password"[URL]