Designing a fallback authentication that is both memorable and strong poses a challenging task due to the need for authentication secrets to remain secure and easily recallable without frequent reinforcement. This could be especially prevalent for cloud computing security and resiliency. Inspired by the robust visual-spatial memory and associative memory of individuals, we introduce AuthZit, a novel system. AuthZit encodes authentication secrets as paths implementing a fault-tolerant algorithm through a 3D map of real-life places, navigated in both first person and 2D bird’s-eye perspective, coupled with a loci-tag (textual secret) associated with the location. Two experiments were conducted to iteratively design and evaluate AuthZit. First, it was observed that visual-spatial secrets are most memorable when navigated through a combination of 3D first-person and 2D bird’s-eye view perspectives. Second, we evaluated AuthZit against security questions and Android’s 9-dot pattern lock across three dimensions: memorability, security, and speed. AuthZit’s complexity-controlled secrets were significantly more memorable after three months, more resilient to shoulder surfing, and close adversaries.

Designing a fallback authentication mechanism that is both memorable and strong is a challenging problem because of the trade-off between usability and security. Security questions are popularly used as a fallback authentication method for password recovery.However, they are prone to guessing attacks by users' acquaintances and may be hard to recall. To overcome these limitations, we present PassTag, a hybrid password scheme that takes advantage of both graphical and textual password authentication methods. PassTag combines a user-provided image and a short personalized text description of the image, imagetag, as an authentication secret.Furthermore, PassTag incorporates decoy images to make it difficult to guess the user-provided pictures. We conducted three user studies with 161 participants for up to three months to evaluate the performance of PassTag against security questions. The evaluation results demonstrate that PassTag is significantly stronger against close adversaries and highly memorable (92.6%-95.0%) after one,two, and three months, respectively. Our longitudinal study results show PassTag is a promising alternative for fallback authentication.

Many companies offer automatic speech recognition or Speech-to-Text APIs for use in diverse applications. However, audio classification algorithms trained with deep neural networks (DNNs) can sometimes misclassify adversarial examples, posing a significant threat to critical applications. In this paper, we present a novel way to create adversarial audio examples using a genetic algorithm. Our algorithm creates adversarial examples by iteratively adding perturbations to the original audio signal. Unlike most white-box adversarial example generations, our approach does not require knowledge about the target DNN's model and parameters (black-box) and heavy computational power of GPU resources. To show the feasibility of the proposed idea, we implement a tool called, Foolgle, using a genetic algorithm that performs untargeted attacks to create adversarial audio examples and evaluate those with the state-of-the-art Google Cloud Speech-to-Text API. Our preliminary experiment results show that Foolgle deceives the API with a success probability of 86%.

In this paper, we introduce SNudge which is a simple tweak on the user interface of in-display fingerprint authentication to nudge users to wipe their fingerprint and resist smudge attacks. We conducted an IRB-approved user study to evaluate the performance of SNudge in which users prefer to use the SNudge 93.6% of the time. Our results demonstrate that SNudge is an effective and unobtrusive nudge to authenticate.