Effective and Efficient Approach to Web Accounts Management and Authentication Minimizing Password Compromise Risk and Possible Loss

Abstract

Using distinct and high-entropy passwords in different accounts is a good principle for security, but it is very inconvenient or even impractical for many users because it is very difficult for people to memorize several distinct, high-entropy passwords. Therefore, despite the high risks, many users are still apt to use simple passwords or even a single password in many accounts for its convenience. Contrary to the conventional inconvenient approach that requires users memorize high-entropy passwords and periodically change them, this paper proposes and implements a new approach to managing the password accounts so as to minimize the possible password- compromise risk and the loss caused by compromised passwords while keeping the convenience and the scalability. This approach well integrates with existing systems and incurs only minimum cost.