{'fraction_non_alphanumeric': 0.021866840731070498, 'fraction_numerical': 0.00032637075718015666, 'mean_word_length': 4.644567219152854, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Security Through Entertainment : Using a Memory Game for Secure Device Pairing

Wireless communication channels are easy to eavesdrop upon and manipulate. Securing them is therefore a fundamental security objective. “Pairing” refers to the operation of bootstrapping secure communication between two wireless devices. An established research direction to solving the pairing dilemma is to leverage an out-of-band (OOB) channel, which is governed by device users. Unlike classical radio channels, OOB channels are “human-perceptible.” That is, a user can validate the intended source of an OOB message and an adversary can not manipulate them in transit. However, prior work shows that this approach to pairing can be prone to human errors of different forms that may directly or indirectly translate into man-in-the-middle attacks. The challenges associated with pairing motivate the design of a radically different solution. Our central research question is: can we design pairing methods that in some way incentivize users to correctly take part in the pairing process, thus improving both security and the user experience? To address this issue, we propose that the pairing process be reframed not as a tedious procedure that puts a burden on users, but rather as a game that is enjoyable and entertaining to complete. It is our aim to transform the operation of device pairing from one that users seek to avoid or complete as quickly as possible into one that they relish. As a result, users will be more attentive while pairing and perform better at it. Furthermore, if a game involves competitiveness between individuals, this will provide added motivation. In essence, we are suggesting that by contextualizing a security task as a game rather than a chore, the usability burden of this task can be greatly reduced. We dub this the Tom Sawyer Effect after a well known event in Mark Twain’s literary classic, “The Adventures of Tom Sawyer” [3]. In this novel, the boy Tom Sawyer is chastised by his Aunt Polly by being forced to paint a fence on his day off. Tom resents the fact that he must complete this task instead of enjoying his free day by playing games with his friends. To escape his plight, the clever Sawyer acts as though he is having a good time performing his task rather than resenting it. Upon observing his supposed delight, his friends insist that they be given an opportunity to paint the fence so that they can enjoy it as well, going as far as to trade him trinkets for the opportunity to do so. Much in the same way that Tom convinces his friends to complete what would otherwise be considered an uninteresting job by treating it as a game, we seek to persuade users to be attentive during security operations, such as device pairing, by making them as interactive and entertaining as possible. To this end, we develop “Alice Says,” a pairing game based on Simon, a popular memory game. This game is designed for a setting where there are two users, each of which is in control of his or her own mobile phone or other personal device.