Publication statistics
Pub. period:2008-2012
Pub. count:9
Number of co-authors:18
Co-authors
Number of publications with 3 favourite co-authors:
Eiji Hayashi:5Patrick Gage Kelley:3Michelle L. Mazurek:3 Productive colleagues
Nicolas Christin's 3 most productive colleagues in number of publications:
Lorrie Faith Crano..:44Jason Hong:20Serge Egelman:13
“
The theory gives the answers, not the theorist.
”
-- Allen Newell
Featured chapter
Read the fascinating history of Wearable Computing, told by its father, Steve Mann
Read Steve's chapter !
Nicolas Christin
Publications by Nicolas Christin (bibliography)
Shay, Richard, Kelley, Patrick Gage, Komanduri, Saranga, Mazurek, Michelle L., Ur, Blase, Vidas, Timothy, Bauer, Lujo, Christin, Nicolas and Cranor, Lorrie Faith (2012): Correct horse battery staple: exploring the usability of system-assigned passphrases. In: Proceedings of the 2012 Symposium on Usable Privacy and Security 2012. p. 7.
“Users tend to create passwords that are easy to guess, while system-assigned passwords tend to be hard to remember. Passphrases, space-delimited sets of natural language words, have been suggested as both secure and usable for decades. In a 1,476-participant online study, we explored the usability of 3- and 4-word system-assigned passphrases in comparison to system-assigned passwords composed of 5 to 6 random characters, and 8-character system-assigned pronounceable passwords. Contrary to expectations, system-assigned passphrases performed similarly to system-assigned passwords of similar entropy across the usability metrics we examined. Passphrases and passwords were forgotten at similar rates, led to similar levels of user difficulty and annoyance, and were both written down by a majority of participants. However, passphrases took significantly longer for participants to enter, and appear to require error-correction to counteract entry mistakes. Passphrase usability did not seem to increase when we shrunk the dictionary from which words were chosen, reduced the number of words in a passphrase, or allowed users to change the order of words.”
© All rights reserved Shay et al. and/or their publisher
Hayashi, Eiji, Hong, Jason and Christin, Nicolas (2011): Security through a different kind of obscurity: evaluating distortion in graphical authentication schemes. In: Proceedings of ACM CHI 2011 Conference on Human Factors in Computing Systems 2011. pp. 2055-2064.
“While a large body of research on image-based authentication has focused on memorability, comparatively less attention has been paid to the new security challenges these schemes may introduce. Because images can convey more information than text, image-based authentication may be more vulnerable to educated guess attacks than passwords. In this paper, we evaluate the resilience of a recognition-based graphical authentication scheme using distorted images against two types of educated guess attacks through two user studies. The first study, consisting of 30 participants, investigates whether distortion prevents educated guess attacks primarily based on information about individual users. The second study, using Amazon Mechanical Turk, investigates whether distortion mitigates the risk of educated guess attacks based on collective information about users. Our results show that authentication images without distortion are vulnerable to educated guess attacks, especially when information about the target is known, and that distortion makes authentication images more resilient against educated guess attacks.”
© All rights reserved Hayashi et al. and/or their publisher
Komanduri, Saranga, Shay, Richard, Kelley, Patrick Gage, Mazurek, Michelle L., Bauer, Lujo, Christin, Nicolas, Cranor, Lorrie Faith and Egelman, Serge (2011): Of passwords and people: measuring the effect of password-composition policies. In: Proceedings of ACM CHI 2011 Conference on Human Factors in Computing Systems 2011. pp. 2595-2604.
“Text-based passwords are the most common mechanism for authenticating humans to computer systems. To prevent users from picking passwords that are too easy for an adversary to guess, system administrators adopt password-composition policies (e.g., requiring passwords to contain symbols and numbers). Unfortunately, little is known about the relationship between password-composition policies and the strength of the resulting passwords, or about the behavior of users (e.g., writing down passwords) in response to different policies. We present a large-scale study that investigates password strength, user behavior, and user sentiment across four password-composition policies. We characterize the predictability of passwords by calculating their entropy, and find that a number of commonly held beliefs about password composition and strength are inaccurate. We correlate our results with user behavior and sentiment to produce several recommendations for password-composition policies that result in strong passwords without unduly burdening users.”
© All rights reserved Komanduri et al. and/or their publisher
Shay, Richard, Komanduri, Saranga, Kelley, Patrick Gage, Leon, Pedro Giovanni, Mazurek, Michelle L., Bauer, Lujo, Christin, Nicolas and Cranor, Lorrie Faith (2010): Encountering stronger password requirements: user attitudes and behaviors. In: Proceedings of the 2010 Symposium on Usable Privacy and Security 2010. p. 2.
“Text-based passwords are still the most commonly used authentication mechanism in information systems. We took advantage of a unique opportunity presented by a significant change in the Carnegie Mellon University (CMU) computing services password policy that required users to change their passwords. Through our survey of 470 CMU computer users, we collected data about behaviors and practices related to the use and creation of passwords. We also captured users' opinions about the new, stronger policy requirements. Our analysis shows that, although most of the users were annoyed by the need to create a complex password, they believe that they are now more secure. Furthermore, we perform an entropy analysis and discuss how our findings relate to NIST recommendations for creating a password policy. We also examine how users answer specific questions related to their passwords. Our results can be helpful in designing better password policies that consider not only technical aspects of specific policy rules, but also users' behavior in response to those rules.”
© All rights reserved Shay et al. and/or their publisher
Hayashi, Eiji, Hong, Jason and Christin, Nicolas (2009): Educated guess on graphical authentication schemes: vulnerabilities and countermeasures. In: Proceedings of the 2009 Symposium on Usable Privacy and Security 2009. p. 25.
Hasegawa, Madoka, Christin, Nicolas and Hayashi, Eiji (2009): New directions in multisensory authentication. In: Proceedings of the 2009 Symposium on Usable Privacy and Security 2009. p. 44.
Sasamoto, Hirokazu, Christin, Nicolas and Hayashi, Eiji (2008): Undercover: authentication usable in front of prying eyes. In: Proceedings of ACM CHI 2008 Conference on Human Factors in Computing Systems April 5-10, 2008. pp. 183-192.
“A number of recent scams and security attacks (phishing, spyware, fake terminals, ...) hinge on a crook's ability to observe user behavior. In this paper, we describe the design, implementation, and evaluation of a novel class of user authentication systems that are resilient to observation attacks. Our proposal is the first to rely on the human ability to simultaneously process multiple sensory inputs to authenticate, and is resilient to most observation attacks. We build a prototype based on user feedback gained through low fidelity tests. We conduct a within-subjects usability study of the prototype with 38 participants, which we complement with a security analysis. Our results show that users can authenticate within times comparable to that of graphical password schemes, with relatively low error rates, while being considerably better protected against observation attacks. Our design and evaluation process allows us to outline design principles for observation-resilient authentication systems.”
© All rights reserved Sasamoto et al. and/or ACM Press
Hayashi, Eiji, Dhamija, Rachna, Christin, Nicolas and Perrig, Adrian (2008): Use Your Illusion: secure authentication usable anywhere. In: Proceedings of the 2008 Symposium on Usable Privacy and Security 2008. pp. 35-45.
“In this paper, we propose and evaluate Use Your Illusion, a novel mechanism for user authentication that is secure and usable regardless of the size of the device on which it is used. Our system relies on the human ability to recognize a degraded version of a previously seen image. We illustrate how distorted images can be used to maintain the usability of graphical password schemes while making them more resilient to social engineering or observation attacks. Because it is difficult to mentally "revert" a degraded image, without knowledge of the original image, our scheme provides a strong line of defense against impostor access, while preserving the desirable memorability properties of graphical password schemes. Using low-fidelity tests to aid in the design, we implement prototypes of Use Your Illusion as i) an Ajax-based web service and ii) on Nokia N70 cellular phones. We conduct a between-subjects usability study of the cellular phone prototype with a total of 99 participants in two experiments. We demonstrate that, regardless of their age or gender, users are very skilled at recognizing degraded versions of self-chosen images, even on small displays and after time periods of one month. Our results indicate that graphical passwords with distorted images can achieve equivalent error rates to those using traditional images, but only when the original image is known.”
© All rights reserved Hayashi et al. and/or ACM Press
Grossklags, Jens, Christin, Nicolas and Chuang, John (2008): Secure or insure?: a game-theoretic analysis of information security games. In: Proceedings of the 2008 International Conference on the World Wide Web 2008. pp. 209-218.
“Despite general awareness of the importance of keeping one's system secure, and widespread availability of consumer security technologies, actual investment in security remains highly variable across the Internet population, allowing attacks such as distributed denial-of-service (DDoS) and spam distribution to continue unabated. By modeling security investment decision-making in established (e.g., weakest-link, best-shot) and novel games (e.g., weakest-target), and allowing expenditures in self-protection versus self-insurance technologies, we can examine how incentives may shift between investment in a public good (protection) and a private good (insurance), subject to factors such as network size, type of attack, loss probability, loss magnitude, and cost of technology. We can also characterize Nash equilibria and social optima for different classes of attacks and defenses. In the weakest-target game, an interesting result is that, for almost all parameter settings, more effort is exerted at Nash equilibrium than at the social optimum. We may attribute this to the "strategic uncertainty" of players seeking to self-protect at just slightly above the lowest protection level.”
© All rights reserved Grossklags et al. and/or ACM Press
Show this list on your homepage
Join the technology elite and advance:
Changes to this page (author)
23 Nov 2012: Added05 Jul 2011: Added05 Jul 2011: Added
02 Nov 2010: Added
16 Feb 2010: Modified
08 Sep 2009: Added
08 Sep 2009: Added
09 Jul 2009: Added
08 Apr 2009: Added
12 May 2008: Added
Page Information
Page maintainer:
The Editorial Team
URL: http://www.interaction-design.org/references/authors/nicolas_christin.html
Log in !
