Building Better Backup Authentication Mechanisms: 
Password Recovery for Financial Services Websites

Steve Houston, Ari Rabkin, Mao Ye

We are interested in examining the security of password recovery mechanisms, primarily in the context of financial institutions. Most financial services companies, such as banks, credit cards, and brokerages, offer a web-based interface. Almost invariably, authentication is via passwords, and almost invariably, there is a mechanism by which users can recover or reset a lost password. These mechanisms generally require users to both control their initial email address, and also to answer some personal questions. 

Anecdote suggests that these systems are often insecure and cumbersome to use. This is a serious security problem, since billions of dollars are at risk. We seek to examine the security and usability of current systems, and propose more effective mechanisms. We believe that the appropriate goal should be a system that is easy to deploy and use, sufficiently difficult to break that an attacker would pick other targets, and constructed in such a way that the resources spent attacking one user do not provide an advantage in targeting another. (In particular, this means that we seek to stop all automated attacks.)

Moreover, only a very limited quantity of academic work has been done on the topic. There is substantial literature on the security and memorability of passwords [1], but not on the security and memorability of knowledge-based questions.  O'Gorman et al [2] describe the use of non-personal entrenched knowledge-based questions (called QDP) for customer verification.  They  compare the security of QDP against traditional knowledge-based questions, and formulate several security requirements that will be applicable to our project.  However, they conduct no extensive usability test, and their approach is limited to call center verification and audio-only questions. 

We will begin by analyzing and evaluating the password retrieval mechanisms for a number (5-10) of banks and financial services websites. Between the members of our group, we have accounts with around ten major financial services companies. We will evaluate the lost-password mechanisms they use, and see if any interesting patterns emerge in the mechanisms of the websites we study. We are particularly interested in how many websites deploy "unconventional" security measures, relying on things other than simply knowledge of answers to questions.  We will conduct a small user survey to determine how easily users can recall answers to currently used security questions, whether the security questions proposed by the banks offer enough user choice, and whether users are able to make judgments about the security of their password retrieval questions. (One question we intend to investigate is the prevalence of questions that are simply inapplicable to some users: for instance, "what was your first pet's name" does not apply to a large fraction of the population.)

We will then attempt to develop better mechanisms. We have two approaches in mind.  First, multimedia-cued recall, where users are presented with images or audio clips and asked questions about them. The logic behind this is that an attacker cannot easily use a voice or an image as a search key in trying to discover the answer, but humans are very good at recognizing pictures and sounds. Given the increasing prevalence of cameras and microphones in personal computers, these approaches are becoming increasingly feasible. Second, we are interested in multifactor authentication, such as schemes requiring users to prove control of an email address, a cell phone, or some other device, as part of the authentication process.

Our proposed approach[es] will be evaluated in terms of both usability and security. Our evaluation will include performing user studies, ideally with a functioning mockup, but at least with questionnaires to evaluate practicality and user willingness to use the system.  

References
1.	J. Yan, A. Blackwell, R. Anderson, A. Grant, "The Memorability and Security of Passwords - Some Empirical Results," TR 500, University of Cambridge, Computer Laboratory, September 2000.
2.	L. O'Gorman, A. Bagga, J. Bentley, "Call Center Customer Verification by Query-Directed Passwords," Proceedings of Financial Cryptography, February 2004.