Understanding the Design Space of Embodied Passwords based on Muscle Memory

Title of the Paper

Understanding the Design Space of Embodied Passwords Based on Muscle Memory

Paper Information

• Subject Area: Human-Computer Interaction (HCI), Authentication and Cryptography
• Keywords: Embodied Interaction, Muscle Memory, Distinctiveness, Usable Security, Cryptography, Morphological Design, Interaction Design
• Conference: CHI Conference on Human Factors in Computing Systems (CHI ’21), Yokohama, Japan
• Authors: Rosa van Koningsbruggen, Bart Hengeveld, Jason Alexander

Research Background and Problem

Issues and Challenges

• Security and Memory Burden: Traditional alphanumeric passwords are often difficult for users to remember due to their complexity, leading to insecure practices such as reusing passwords or storing them on unsafe media.
• Password Alternatives: While biometric passwords, graphical passwords, or muscle memory-based passwords show potential, their forms, interaction modes, and practicality still require exploration.
• Research Gap: Although preliminary studies suggest that muscle memory can support motion-based password systems, systematic research on the design morphology, interaction design, and "design space" of muscle memory passwords is lacking.

Significance

• Novel password systems, such as those based on muscle memory, have the potential to reduce users' cognitive burden while introducing creative and personalized interaction methods that align with natural user experiences.

Research Objectives

• To explore the design space of muscle memory passwords, including interaction design, morphological constraints (e.g., motion space, ergonomic characteristics), and password memorability.
• To develop and test password prototypes using "embodied interaction" and "Research Through Design" methodologies.

Solution

Methods and Proposed Approach

• Research Framework: The authors employed exploratory and iterative experimental methods, including an initial exploration and five experiments focusing on the following themes:
  1. Motion Space: How should the motion path/space of passwords be designed, and what boundary conditions should be defined?
  2. Physical Object Configuration: Designing interactive prototypes that guide muscle memory to test their applicability and security.
  3. Memorability and Uniqueness: Evaluating users' memory performance for designed passwords and their consistency over different time intervals.

Key Steps

1. Theoretical Foundation:
   • Utilizing theoretical frameworks from psychology and HCI, such as Embodied Interaction, instinctive actions, and affordances of well-perceived morphological objects.
2. Experimental Design:
   • Preliminary Experiment: Inviting music conductors to express "a sense of security" and "password characteristics" through gestures, analyzing suitable gesture information for passwords.
   • Spatial Experiment: Inviting participants to operate boxes of different sizes to analyze preferences for motion space.
   • Physical Device Experiment: Designing and validating embodied password prototypes, exploring knob morphology, degrees of freedom, and password dynamics.
   • Memorability Experiment: Long-term testing (one day, seven days) to analyze whether users can remember their created passwords and assess dynamic consistency.
3. Tool Development:
   • Using Arduino microcontrollers and rotary sensors to implement dynamic embodied password designs.
   • Developing a visualization feedback system to track password operations and assist in research data analysis.

Highlights of the Approach

1. Intuitiveness of Dynamic Space:

   • The study recommends a password interaction motion space of 200mm × 200mm, which aligns with natural hand extension positions and movement habits.

2. Prototype Interaction Innovation:

   • Proposes the "knob" as the core of interaction, combining dimensions such as "press to start," "rotate to input," and "release to confirm" for password input.

3. Personalized Password Generation Tool:

   • Participants are given the freedom to create personalized passwords, heavily relying on natural movements and rhythm, emphasizing bodily intuition and muscle memory.

Research Outcomes

Specific Achievements

1. Design Principles for Embodied Passwords:

   • Recommended motion characteristics: Actions should be "quick, forceful, controlled," supplemented with elements of "ease and freedom" to enhance complexity and security.
   • Morphological suggestions: Password input devices (e.g., knobs) should accommodate users' hand sizes while balancing perceived security (small size) and ergonomic comfort.

2. Memorability Assessment:

   • Participants successfully remembered and reproduced their created passwords 100% of the time during experiments conducted a week later, performing as well as or better than traditional alphanumeric passwords.
   • Rule-based hints (visual password maps) significantly improved password recall.

3. Uniqueness and Interaction Experience:

   • All designed passwords were entirely unique, demonstrating high personalization.
   • Users reported that these passwords felt more "private" and "intuitive," creating a pleasant and immersive interaction experience.

Advantages Compared to Existing Technologies

• Creates a more natural and memorable password alternative compared to traditional complex alphanumeric/biometric passwords, with adaptability across different contexts.
• Validates the usability of motion-based password systems grounded in human actions and habitual learning, addressing the design guidance gap for motion-based password technologies.

Experimental Limitations and Future Directions

• Limitations: The sample size was relatively small, and experiments were primarily conducted among students with backgrounds in design and HCI, introducing potential bias. The time span was short, limiting verification of long-term memory retention.
• Future Directions:
  • Incorporating feedback mechanisms (e.g., tactile cues) and detailed experiential elements to enhance users' sense of security during operations.
  • Unlocking the gradual progression of long-term muscle memory, exploring password recall over months or even years without use.
  • Security assessment: Introducing observation-based cracking experiments to evaluate the potential risk of password replication when observed.

Conclusion

This paper explores the design space of embodied passwords, providing specific design guidance, evaluation methods, and performance validation for password systems centered on muscle memory. The results confirm the innovative potential of such passwords and suggest further research to balance and optimize practicality, security, and user experience.