Reusing passwords across multiple websites is a common practice that
compromises security. Recently, Blum and Vempala have proposed password
strategies to help people calculate, in their heads, passwords for different
sites without dependence on third-party tools or external devices. Thus far,
the security and efficiency of these "mental algorithms" has been analyzed only
theoretically. But are such methods usable? We present the first usability
study of humanly computable password strategies, involving a learning phase (to
learn a password strategy), then a rehearsal phase (to login to a few
websites), and multiple follow-up tests. In our user study, with training,
participants were able to calculate a deterministic eight-character password
for an arbitrary new website in under 20 seconds
