What Your Brain Says About Your Password: Using Brain-Computer Interfaces to Predict Password Memorability

Recent advances in brain-computer interfaces (BCI) have enabled them as affordable consumer-grade devices for nonmedical purposes such as academic research, marketing, and entertainment. We report on the possibility of using BCIs to classify passwords into two classes—one class may be deemed as memorable and the other one as non-memorable—based on electroencephalogram (EEG) potentials collected by the BCI upon presenting the passwords to human participants. The memorable set consists of the most commonly used passwords, also known as "worst passwords lists", while the non-memorable set consists of randomly generated strings of characters, symbols, and numbers. When classifying passwords as memorable vs. nonmemorable, a classification accuracy of 76.5% was achieved. We found a positive correlation between password EEG features and password recall. We also report on users' choice of passwords, where 74% of participants were found to inadvertently choose the password with higher elicited voltage, when presented with two passwords to choose from.