5.4 Password-based authentication
Password-based authentication is arguably the most common way used to authenticate humans to electronic devices. An average internet user has about 70 to 80 passwords to identify themself to websites they visit and services they use [130].
Most existing password schemes use time-invariant passwords. The user initially chooses a string of characters, typically short enough so they can memorize it. From this point in time onward, that password is associated with the user ID, for instance, the username or the email address entered during registration.
The password is a secret shared between the user and the electronic system. Hence, from a cryptographic perspective, password-based authentication is a symmetric mechanism (it is based on a common secret) that provides unilateral authentication. The authentication is unilateral because the user authenticates themself to the system, but the system – an electronic device or a web service –...
