An Empirical Study of Textual Key-Fingerprint Representations
summary
An online experiment with 1047 participants compares six textual fingerprint formats (hexadecimal baseline, base32, numeric, PGP word list, large wordlist, and generated sentences) using simulated partial preimage attacks. Results show hexadecimal baseline yields the worst detection and about 10% undetected attacks for the chosen attacker strength, while sentence-based encoding gives the highest attack detection and best usability ratings; numeric encodings outperform hex when language-based options are unavailable.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:48Do Users Verify Ssh Keys
- 4:39Pgp Word List
- 12:27Attention Tests with Obvious Mismatches
- 12:49Training Sets
- 13:50The Challenges We Had during the Study
- 15:38Experiment Results
- 17:27Chunking Experiments
related talks
19mCan Unicorns Help Users Compare Crypto Key Fingerprints?
40mAn Analysis of the Fingerprinting-Scripts and their Actors on the Internet
56mHomoglyph-Based Attacks: Circumventing LLM Detectors
34mNavigating the Vast Ocean of Browser Fingerprints
12mUse Your Words: Designing One-time Pairing Codes to Improve User Experience
40mLive autopsy of a password: lessons learnt cracking secrets
41mHow Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack Surfaces
21mFp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies