Geographic Hints for Passphrase Authentication We propose and study the use of geographic hints to aid memorability of passphrasestyle authentication secrets. Geographic hints are map locations that are selected by the user at the time of passphrase creation, and shown to the user as a hint at the time of passphrase login. We implement the GeoHints system and analyze how geographic hints impact the usability and security of passphrasestyle secrets in a multisession user study (n38). The study involved testing for multiple passphrase interferenceeach participant was asked to recall 4 distinct passphrases. Our study indicates that while geographic hints showed promise for reducing memory interference, GeoHints (as implemented) does not produce a viable authentication system, as the login success rate was 25% 7xe2x80x9311 days after passphrase selection. We analyze the root causes of login errors, finding that most were due to inexact recall of freeform text input. This finding points towards opportunities to improve the system design, and we suggest improvements that we believe will lead to viable systems that employ geographic hints.

Lost in Disclosure: On the Inference of Password Composition Policies Largescale password data breaches are becoming increasingly commonplace, which has enabled researchers to produce a substantial body of password security research utilising realworld password datasets, which often contain numbers of records in the tens or even hundreds of millions. While much study has been conducted on how password composition policiesxe2x80x94sets of rules that a user must abide by when creating a passwordxe2x80x94influence the distribution of userchosen passwords on a system, much less research has been done on inferring the password composition policy that a given set of userchosen passwords was created under. In this paper, we state the problem with the naive approach to this challenge, and suggest a simple approach that produces more reliable results. We also present polinfer, a tool that implements this approach, and demonstrates its use in inferring password composition policies.