Psychological research on memorability of passwords?

Question

There are lots of ad-hoc rules that people are happy to propose about passwords, such as:

• Pick a phrase you can remember easily, and then use the initial letters.
• A random short sequence of letters, numbers and symbols.
• A sequence of random common words (like XKCD's "battery correct horse staple").

There is also a pile of computer security research on what passwords are hard to crack.

It seems like a pretty simple empirical question to say what is the best password scheme for any given desired strength.

Can anyone point me to any research about the ease of memorizing passwords generated according to various rules?

Answer 1

It looks like there is some empirical evidence that passphrases are easier to remember than either random passwords (not surprising) or user-selected short passwords after standard advice to use mix of upper and lower and avoid words.

http://homepages.cs.ncl.ac.uk/jeff.yan/#exp

Thanks Jeff for the pointer in a comment (same Jeff?).

J. Yan, A. Blackwell, R. Anderson and A. Grant. The memorability and security of passwords -- some empirical results. University of Cambridge, Computer Laboratory Technical Report No. 500, 2000. (see also Hungarian translation). PDF

J. Yan, A. Blackwell, R. Anderson and A. Grant. Password Memorability and Security: Empirical Results. IEEE Security & Privacy, Vol. 2 No. 5, 2004. PDF

the above is reprinted as:

J. Yan, A. Blackwell, R. Anderson and A. Grant. The Memorability and Security of Passwords. Refereed book chapter in Security and Usability: Designing Secure Systems that People Can Use (ed. by Lorrie Cranor and Simson Garfinkel), OReilly & Associates, USA, 2005.