Assessing the User Experience of Password Reset Policies in a University

Abstract

Organisations often provide helpdesk services to users, to resolve any problems that they may have in managing passwords for their provisioned accounts. Helpdesk logs record password change events and support requests, but overlook the impact of compliance upon end-user productivity. System managers are not incentivised to investigate these impacts, so productivity costs remain with the end-user. We investigate how helpdesk log data can be analysed and augmented to expose the user's personal costs. Here we describe exploratory analysis of a university's helpdesk log data, spanning 30 months and 500,000 system events for approximately 10,000 staff and 20,000-plus students. The scale of end-user costs was identified in log data, where follow-on exploratory interviews and NASA-RTLX assessments with 20 students exposed issues which log data did not adequately represent. The majority of users reset passwords before expiration. Log analysis indicated that the online self-service system was vastly preferred to the helpdesk, but that there was a 4:1 ratio of failed to successful attempts to recover account access. Log data did not capture the effort in managing passwords, where interviews exposed points of frustration. Participants saw the need for security but voiced a lack of understanding of the numerous restrictions on passwords. Frustrations led to adoption of diverse coping strategies, for example deliberately waiting to reset a password after reaching the post-expiry grace period. We propose ways to improve support, including real-time communication of reasons for failed password creation attempts, and measurement of timing for both successful and failed login attempts.

A Transcontinental Analysis of Account Remediation Protocols of Popular Websites

“…Account remediation is not only a protocol that websites should follow; it is a complex way that brings in the sociotechnical components to ensure data protection and prevent further data leakage for an account compromise. Additionally, the proper account remediation process enables users to protect their accounts as a preventive measure through secure behavior such as prevention of password rotation [65], [77]. Our transcontinental analysis for the 158 websites measures the account remediation for different aspects like changing passwords, reviewing past activities, enabling 2FA, and others.…”

“…As part of this study, we checked website password requirements and found that, on average, 53% of them do not check for a proper password rotation [65], [77]. This check is possible without any security infringement, as knowledge of the old password also needs to be double-checked.…”