{"id":"https://openalex.org/W2253893204","doi":"https://doi.org/10.1145/2736277.2741691","title":"Secrets, Lies, and Account Recovery","display_name":"Secrets, Lies, and Account Recovery","publication_year":2015,"publication_date":"2015-05-18","ids":{"openalex":"https://openalex.org/W2253893204","doi":"https://doi.org/10.1145/2736277.2741691","mag":"2253893204"},"language":"en","primary_location":{"id":"doi:10.1145/2736277.2741691","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2736277.2741691","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2741691&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th International Conference on World Wide Web","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"http://dl.acm.org/ft_gateway.cfm?id=2741691&type=pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057053404","display_name":"Joseph Bonneau","orcid":"https://orcid.org/0000-0002-6349-0145"},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]},{"id":"https://openalex.org/I1743320","display_name":"Palo Alto University","ror":"https://ror.org/04f812k67","country_code":"US","type":"education","lineage":["https://openalex.org/I1743320"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Joseph Bonneau","raw_affiliation_strings":["Stanford University, Palo Alto, CA, USA"],"affiliations":[{"raw_affiliation_string":"Stanford University, Palo Alto, CA, USA","institution_ids":["https://openalex.org/I1743320","https://openalex.org/I97018004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058819105","display_name":"Elie Bursztein","orcid":"https://orcid.org/0000-0003-0316-6906"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elie Bursztein","raw_affiliation_strings":["Google, Mountain View, CA, USA"],"affiliations":[{"raw_affiliation_string":"Google, Mountain View, CA, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066454322","display_name":"Ilan Caron","orcid":null},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ilan Caron","raw_affiliation_strings":["Google, Mountain View, CA, USA"],"affiliations":[{"raw_affiliation_string":"Google, Mountain View, CA, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109201541","display_name":"Rob Jackson","orcid":null},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rob Jackson","raw_affiliation_strings":["Google, Mountain View, CA, USA"],"affiliations":[{"raw_affiliation_string":"Google, Mountain View, CA, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070853726","display_name":"Michael P. Williamson","orcid":null},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mike Williamson","raw_affiliation_strings":["Google, Mountain View, CA, USA"],"affiliations":[{"raw_affiliation_string":"Google, Mountain View, CA, USA","institution_ids":["https://openalex.org/I1291425158"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5057053404"],"corresponding_institution_ids":["https://openalex.org/I1743320","https://openalex.org/I97018004"],"apc_list":null,"apc_paid":null,"fwci":22.2337,"has_fulltext":true,"cited_by_count":68,"citation_normalized_percentile":{"value":0.99277612,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"141","last_page":"150"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6767008304595947},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.6678361892700195},{"id":"https://openalex.org/keywords/password","display_name":"Password","score":0.6413212418556213},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5957080125808716},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5954576134681702},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5916776061058044},{"id":"https://openalex.org/keywords/phone","display_name":"Phone","score":0.5741394758224487},{"id":"https://openalex.org/keywords/usability","display_name":"Usability","score":0.542840301990509},{"id":"https://openalex.org/keywords/reliability","display_name":"Reliability (semiconductor)","score":0.47241273522377014},{"id":"https://openalex.org/keywords/reset","display_name":"Reset (finance)","score":0.471737265586853},{"id":"https://openalex.org/keywords/fraction","display_name":"Fraction (chemistry)","score":0.45804470777511597},{"id":"https://openalex.org/keywords/recall","display_name":"Recall","score":0.4404659867286682},{"id":"https://openalex.org/keywords/population","display_name":"Population","score":0.42823082208633423},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.3898448050022125},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.19260504841804504},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.14496400952339172},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.13487231731414795}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6767008304595947},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.6678361892700195},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.6413212418556213},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5957080125808716},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5954576134681702},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5916776061058044},{"id":"https://openalex.org/C2778707766","wikidata":"https://www.wikidata.org/wiki/Q202064","display_name":"Phone","level":2,"score":0.5741394758224487},{"id":"https://openalex.org/C170130773","wikidata":"https://www.wikidata.org/wiki/Q216378","display_name":"Usability","level":2,"score":0.542840301990509},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.47241273522377014},{"id":"https://openalex.org/C2779795794","wikidata":"https://www.wikidata.org/wiki/Q7315343","display_name":"Reset (finance)","level":2,"score":0.471737265586853},{"id":"https://openalex.org/C149629883","wikidata":"https://www.wikidata.org/wiki/Q660926","display_name":"Fraction (chemistry)","level":2,"score":0.45804470777511597},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.4404659867286682},{"id":"https://openalex.org/C2908647359","wikidata":"https://www.wikidata.org/wiki/Q2625603","display_name":"Population","level":2,"score":0.42823082208633423},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3898448050022125},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.19260504841804504},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.14496400952339172},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.13487231731414795},{"id":"https://openalex.org/C180747234","wikidata":"https://www.wikidata.org/wiki/Q23373","display_name":"Cognitive psychology","level":1,"score":0.0},{"id":"https://openalex.org/C178790620","wikidata":"https://www.wikidata.org/wiki/Q11351","display_name":"Organic chemistry","level":1,"score":0.0},{"id":"https://openalex.org/C163258240","wikidata":"https://www.wikidata.org/wiki/Q25342","display_name":"Power (physics)","level":2,"score":0.0},{"id":"https://openalex.org/C149923435","wikidata":"https://www.wikidata.org/wiki/Q37732","display_name":"Demography","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2736277.2741691","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2736277.2741691","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2741691&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th International Conference on World Wide Web","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/2736277.2741691","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2736277.2741691","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2741691&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th International Conference on World Wide Web","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2253893204.pdf","grobid_xml":"https://content.openalex.org/works/W2253893204.grobid-xml"},"referenced_works_count":33,"referenced_works":["https://openalex.org/W48410280","https://openalex.org/W128619364","https://openalex.org/W170161968","https://openalex.org/W173470260","https://openalex.org/W563958770","https://openalex.org/W1509135693","https://openalex.org/W1566273181","https://openalex.org/W1605303397","https://openalex.org/W1921097329","https://openalex.org/W1999298106","https://openalex.org/W2008257424","https://openalex.org/W2023219597","https://openalex.org/W2024562548","https://openalex.org/W2036862790","https://openalex.org/W2048755632","https://openalex.org/W2057213338","https://openalex.org/W2059621117","https://openalex.org/W2075940395","https://openalex.org/W2107911557","https://openalex.org/W2109878465","https://openalex.org/W2110695853","https://openalex.org/W2113936660","https://openalex.org/W2124686424","https://openalex.org/W2126453598","https://openalex.org/W2129091997","https://openalex.org/W2131161593","https://openalex.org/W2135866194","https://openalex.org/W2148279836","https://openalex.org/W2148935141","https://openalex.org/W2162176660","https://openalex.org/W2167033747","https://openalex.org/W2350778671","https://openalex.org/W2542799811"],"related_works":["https://openalex.org/W350273603","https://openalex.org/W2393495588","https://openalex.org/W96259911","https://openalex.org/W4385608460","https://openalex.org/W2168225754","https://openalex.org/W2370772865","https://openalex.org/W2000034628","https://openalex.org/W1528611913","https://openalex.org/W2611670505","https://openalex.org/W4250612415"],"abstract_inverted_index":{"We":[0,225],"examine":[1],"the":[2,49,55,112,121,127,140,181,202,207,219,222],"first":[3,214],"large":[4],"real-world":[5],"data":[6],"set":[7],"on":[8,107],"personal":[9],"knowledge":[10],"question's":[11],"security":[12,29],"and":[13,123,198,241,261],"memorability":[14,138,199],"from":[15],"their":[16,118,143,146,173],"deployment":[17],"at":[18],"Google.":[19],"Our":[20],"analysis":[21],"confirms":[22],"that":[23,31,62,70,82,132,142,201,204,227,237],"secret":[24,133,235],"questions":[25,203,236,244],"generally":[26],"offer":[27],"a":[28,63,83,157],"level":[30],"is":[32,69,178,212],"far":[33],"lower":[34,44,179],"than":[35,45,180],"user-chosen":[36],"passwords.":[37],"It":[38],"turns":[39],"out":[40],"to":[41,91,100,104,171,231,233],"be":[42,258],"even":[43],"proxies":[46],"such":[47,188],"as":[48,115,189],"real":[50],"distribution":[51],"of":[52,66,86,151,160,164,184],"surnames":[53],"in":[54,97,120],"population":[56],"would":[57],"indicate.":[58],"Surprisingly,":[59],"we":[60,79,130,155],"found":[61],"significant":[64,84,158],"cause":[65],"this":[67,109],"insecurity":[68],"users":[71,87,161],"often":[72],"don't":[73],"answer":[74],"truthfully.":[75],"A":[76],"user":[77],"survey":[78],"conducted":[80],"revealed":[81],"fraction":[85,159],"(37%)":[88],"who":[89],"admitted":[90],"providing":[92],"fake":[93],"answers":[94,119,134,174],"did":[95],"so":[96],"an":[98],"attempt":[99],"make":[101],"them":[102],"\"harder":[103],"guess\"":[105],"although":[106],"aggregate":[108],"behavior":[110],"had":[111],"opposite":[113],"effect":[114],"people":[116],"\"harden\"":[117],"same":[122],"predictable":[124],"way.":[125],"On":[126],"usability":[128],"side,":[129],"show":[131],"have":[135,246],"surprisingly":[136],"poor":[137],"despite":[139],"assumption":[141],"reliability":[144],"motivates":[145],"continued":[147],"deployment.":[148],"From":[149],"millions":[150],"account":[152],"recovery":[153,186],"attempts":[154],"observed":[156],"(e.g":[162,210],"40%":[163],"our":[165],"English-speaking":[166],"US":[167],"users)":[168],"were":[169],"unable":[170],"recall":[172],"when":[175,249],"needed.":[176],"This":[177],"success":[182],"rate":[183],"alternative":[185],"mechanisms":[187],"SMS":[190],"reset":[191],"codes":[192],"(over":[193],"80%).":[194],"Comparing":[195],"question":[196],"strength":[197],"reveals":[200],"are":[205,217,238],"potentially":[206],"most":[208],"secure":[209,240],"what":[211],"your":[213],"phone":[215],"number)":[216],"also":[218],"ones":[220],"with":[221,251],"worst":[223],"memorability.":[224],"conclude":[226],"it":[228],"appears":[229],"next":[230],"impossible":[232],"find":[234],"both":[239],"memorable.":[242],"Secret":[243],"continue":[245],"some":[247],"use":[248],"combined":[250],"other":[252],"signals,":[253],"but":[254],"they":[255],"should":[256,264],"not":[257],"used":[259],"alone":[260],"best":[262],"practice":[263],"favor":[265],"more":[266],"reliable":[267],"alternatives.":[268]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":6},{"year":2020,"cited_by_count":9},{"year":2019,"cited_by_count":8},{"year":2018,"cited_by_count":6},{"year":2017,"cited_by_count":13},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":3}],"updated_date":"2026-04-14T08:04:32.555800","created_date":"2025-10-10T00:00:00"}