---
abstract: |
    The secure “pairing” of wireless devices based on auxiliary or out-of-band (OOB) communication, such as audio, visual, or tactile channels, is a well-established research direction. However, prior work shows that this approach to pairing can be prone to human errors of different forms that may directly or indirectly translate into man-in-the-middle attacks. To address this problem, we propose a general direction of the use of computer games for pairing. Since games are a popular means of entertainment, our hypothesis is that they may serve as an incentive to users and make the pairing process enjoyable for them, thus improving the usability, as well as the security, of the pairing process.

    We consider an emerging use case of pairing whereby two different users are involved, each in possession of his or her own device (e.g., Alice and Bob pairing their smartphones for social interactions). We develop “Alice Says,” a pairing game based on a popular memory game called Simon (Says), and discuss the underlying design challenges. We also present a *preliminary* evaluation of Alice Says via a usability study and demonstrate its feasibility in terms of usability and security. Our results indicate that overall Alice Says was deemed as a fun and an enjoyable way to pair devices, confirming our hypothesis. However, contrary to our intuition, the relatively slower speed of Alice Says pairing was found to be a cause of concern and prompts the need for the design of faster pairing games. We put forth several ways in which this issue can be ameliorated. In addition, we also discuss several other security problems which are lacking optimal solutions and suggest ideas on how entertainment can be used to improve the current state of the art solutions that have been developed to address them.
author:
- |
    Alexander Gallego\
    \
    \
    \
    Nitesh Saxena\
    \
    \
    \
    Jonathan Voris\
    \
    \
    \
bibliography:
- 'soups.bib'
title: 'Security Through Entertainment: Experiences Using a Memory Game for Secure Device Pairing'
---

Introduction
============

Related Work
============

Design of a Pairing Game {#sec:design}
========================

Implementation of Alice Says {#sec:implementation}
============================

Usability Experimentation {#sec:experimentation}
=========================

Discussion {#sec:discussion}
==========

Conclusions
===========

In this paper, we considered the problem of designing pairing methods that incentivize users, in some way, so that they put forth more effect and correctly take part in the pairing process, thus providing improved security as well as enhancing the overall user experience. We dubbed this the Tom Sawyer Effect. To this end, we proposed a general direction of the application of computer games to solving tricky issues in usable security. The incentive that we provide to the users while they pair their devices is fun and entertainment. Since games are a popular means of entertainment, our hypothesis was that they may improve the security as well as usability of pairing and help solve the challenges outlined above.

We developed “Alice Says,” a pairing game based on a popular memory game called Simon (Says), and discussed the underlying design challenges. We also presented a *preliminary* evaluation of Alice Says via a usability study and demonstrated its feasibility in terms of usability and security. Our results indicate that overall Alice Says was deemed a fun and an enjoyable way to pair devices, confirming our hypothesis. It was also found to be robust to human mistakes. However, contrary to our intuition, the relatively slower speed of Alice Says pairing was found to be a cause of concern, which prompts the need for the design of faster pairing games. We discussed some variations and possible improvements to our current Alice Says prototype, and more broadly, also outlined some of the other interesting applications of games to address lingering security problems.

Acknowledgments
===============

The authors would like to thank Frank Lantz for providing useful suggestions for research directions at the start of this project.

This work was partially supported by an NSF grant 0831397 and the United States Department of Education GAANN grant P200A090157.
