Cost-effective computer security: cognitive and associative passwords

Recall and guessing rates for conventional, cognitive, and word association passwords were compared using 86 Massey University undergraduates. Respondents completed a questionnaire covering all three password types, returning two weeks later for a recall test. Each respondent also nominated a "significant other" (parent, partner, etc.) who tried to guess the respondent's answers. On average, cognitive items produced the highest recall rates (80%) but the guessing rate was also high (39.5%). Word associations produced low guessing rates (7%) but response words were poorly recalled (39%). Nevertheless, both cognitive items and word associations showed sufficient promise as password techniques to warrant further investigation.