Pico in the Wild: Replacing Passwords, One Site at a Time
Open accessAbstract
Passwords are a burden on the user, especially nowadays with an increasing number of accounts and a proliferation of different devices.Pico is a token-based login method that does not ask users to remember any secrets, nor require keyboard entry of one-time passwords.We wish to evaluate its claim of being simultaneously more usable and more secure than passwords, whilst testing its support for frictionless deployment to web-based services.Our main aim is to collect actionable intelligence on how to improve it.In our study, we teamed up with an Alexa Top 500 website, Gyazo, to offer this alternative login mechanism to users intent on performing a real task of image sharing.We focused on the ecological validity of the trial, and gained knowledge both through the challenges of the trial and the results generated.Users appreciated the ability to avoid password entry but the overall benefit was mitigated by the existing measures put in place by Gyazo to minimise the number of times users are presented with a password entry box.Our main finding is that providing enough benefit requires a solution that applies across sites, rather than focusing on authentication for a single site in isolation.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Using thematic analysis in psychology
Braun, V., & Clarke, V. (2006) · Qualitative Research in Psychology · doi:10.1191/1478088706qp063oa · Cited by 194,414 · see citing works
The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
Bonneau, J., Herley, C., Oorschot, P. C. V., & Stajano, F. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.44 · Cited by 1,110 · see citing works
Self-citationA large-scale study of web password habits
Florencio, D., & Herley, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242661 · Cited by 1,047 · see citing works
On User Choice in Graphical Password Schemes
Davis, D., Monrose, F., & Reiter, M. K. (2004) · Cited by 471 · see citing works
Are Passfaces More Usable Than Passwords? A Field Trial Investigation
Brostoff, S., & Sasse, M. A. (2000) · Springer eBooks · doi:10.1007/978-1-4471-0515-2_27 · Cited by 412 · see citing works
Statistical Methods for Rates and Proportions
Conover, W. J., & Fleiss, J. L. (1974) · Technometrics · doi:10.2307/1267960 · Cited by 364 · see citing works
The Password Thicket: Technical and Market Failures in Human Authentication on the Web.
Bonneau, J., & Preibusch, S. (2010) · Cited by 179 · see citing works
Towards reliable storage of 56-bit secrets in human memory
Bonneau, J., & Schechter, S. E. (2014) · Cited by 101 · see citing works
Password portfolios and the finite-effort user: sustainably managing large numbers of accounts
Florencio, D. A. F., Herley, C., & van Oorschot, P. C. (2014) · USENIX Security Symposium · Cited by 87 · see citing works
Experimenting at scale with google chrome's SSL warning
Felt, A. P., Reeder, R. W., Almuhimedi, H., & Consolvo, S. (2014) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/2556288.2557292 · Cited by 74 · see citing works
Krol, K., Philippou, E., Cristofaro, E. D., & Sasse, M. A. (2015) · Workshop on Usable Security (USEC) · doi:10.14722/usec.2015.23001 · Cited by 69 · see citing works
Self-citationEvaluating the usability and security of a graphical one-time PIN system
Brostoff, S., Inglesant, P., & Sasse, M. A. (2010) · Electronic workshops in computing · doi:10.14236/ewic/hci2010.13 · Cited by 40 · see citing works
The Great Authentication Fatigue – And How to Overcome It
Sasse, M. A., Steves, M. P., Krol, K., & Chisnell, D. E. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-07308-8_23 · Cited by 32 · see citing works
Self-citationReport: Authentication Diary Study
Steves, M. P., Chisnell, D. E., Sasse, M. A., Krol, K., Theofanos, M. F., & Wald, H. (2014) · doi:10.6028/nist.ir.7983 · Cited by 29 · see citing works
Self-citationTowards Robust Experimental Design for User Studies in Security and Privacy
Krol, K., Spring, J., Parkin, S. E., et al. (2016) · UCL Discovery (University College London) · Cited by 24 · see citing works
Self-citationPRODUCTIVITY AND USABILITY EFFECTS OF USING A TWO-FACTOR SECURITY SYSTEM
Strouble, D., Alan, M., & Alsop, S. (2009) · Journal of the Association for Information Systems · Cited by 22 · see citing works
Better the Devil You Know: A User Study of Two CAPTCHAs and a Possible Replacement Technology
Krol, K., Parkin, S. E., & Sasse, M. A. (2016) · doi:10.14722/usec.2016.23013 · Cited by 19 · see citing works
Self-citationStajano, F., Christianson, B., Lomas, M., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-26096-9_21 · Cited by 8 · see citing works
Self-citationJenkinson, G., Spencer, M., Warrington, C., et al. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-12400-1_19 · Cited by 7 · see citing works
Self-citation“Too Taxing on the Mind!” Authentication Grids are not for Everyone
Krol, K., Papanicolaou, C., Vernitski, A., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-20376-8_7 · Cited by 7 · see citing works
Self-citationResponsibility and Tangible Security: Towards a Theory of User Acceptance of Security Tokens
Payne, J., Jenkinson, G., Stajano, F., et al. (2016) · doi:10.14722/usec.2016.23003 · Cited by 7 · see citing works
Self-citationGathering realistic authentication performance data through field trials
Beautement, A., & Sasse, M. A. (2010) · UCL Discovery (University College London) · Cited by 4 · see citing works
Low-Cost Mitigation Against Cold Boot Attacks for an Authentication Token
Goldberg, I., Jenkinson, G., & Stajano, F. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-39555-5_3 · Cited by 4 · see citing works
Self-citation
Flagged first, then by citations
Research works printed but not linked: 3
- [6]6. F. Stajano, "Pico: No More Passwords!"," in Security Protocols XIX, B. Christianson, B. Crispo, J. Malcolm, and F. Stajano, Eds. Springer International Publishing, 2011, pp. 49-81.
- [7]7. R. Morris and K. Thompson, "Password security: A case history," Communications of the ACM, vol. 22, no. 11, 1979.
- [8]8. R. Biddle, S. Chiasson, and P. C. van Oorschot, "Graphical passwords: Learning from the first twelve years," ACM Computing Surveys (CSUR), vol. 44, no. 4, p. 19, 2012.
Cited by
Sorted by citations
Ghorbani Lyastani, S., Schilling, M., Neumayr, M., Backes, M., & Bugiel, S. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00047 · Cited by 108 · see citing works
- Authors
- Aebischer, S., Dettoni, C., Jenkinson, G., Krol, K., Llewellyn-Jones, D., Masui, T., & Stajano, F.
- Affiliations
- University of Cambridge (GB)
- Keio University (JP)
- Corresponding author
- Masui, Toshiyuki
- ORCID
- Stajano, Frank
- Venue
- Proceedings 2nd European Workshop on Usable Security
- Publisher
- Internet Society
- Published
- 2017
- OpenAlex
- W4246663832
- Cited by
- 6
- References
- 23
- Citations by year
- 2025: 2 · 2023: 1 · 2022: 1 · 2020: 1 · 2017: 1
- FWCI
- 0.42
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- European Symposium on Usable Security (EuroUSEC) (publishedVersion)
- Funders
- Engineering and Physical Sciences Research Council (EP/M019055/1)
- FP7 Ideas: European Research Council (307224)
- Topics
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Keywords
- password replacement, one-time password, web authentication, usability, security (computing), image sharing, ecological validity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
