Does my password go up to eleven?

Abstract

Password meters tell users whether their passwords are "weak" or "strong." We performed a laboratory experiment to examine whether these meters influenced users' password selections when they were forced to change their real passwords, and when they were not told that their passwords were the subject of a study. We observed that the presence of meters yielded significantly stronger passwords. We performed a followup field experiment to test a different scenario: creating a password for an unimportant account. In this scenario, we found that the meters made no observable difference: participants simply reused weak passwords that they used to protect similar low-risk accounts. We conclude that meters result in stronger passwords when users are forced to change existing passwords on "important" accounts and that individual meter design decisions likely have a marginal impact.

Increasing Security Sensitivity With Social Proof

“…For example, activating Login Approvals would require people to spend an extra few seconds every time they "logged in" to their Facebook accounts. Taken together with the previous finding that people generally only enact security and privacy related behavior change after personally experiencing or hearing about a threat [9], and Egelman and colleagues' finding that a "peer pressure" password meter did not raise people's motivation to create stronger passwords relative to a non-social password meter [14], we expected that, in the short term, there would be no difference in security feature adoption rate among those who view social and non-social announcements.…”

“…Taken together, all this prior work strongly suggests that increasing the observability of friends' security feature use can heighten people's security sensitivity, though Egelman and colleagues' [14] null result with their peer pressure password meter suggests that the specificity and framing of social information may moderate its effect. To test these conjectures, in this work, we sought to answer the following questions: (1) Does increasing the observability of security feature usage drive the exploration and adoption of security features?…”

“…Egelman and colleagues [14] included a simple social condition in their study on the effects of various types of password meters on convincing people to create stronger passwords. They found that a "peer pressure" password meter that showed participants how strong their passwords were relative to other "users" performed no better in increasing the strength of participants' composed passwords, as compared to a standard password meter that told participants whether their passwords were "weak", "medium" or "strong".…”

The password practices applied by South African online consumers: Perception versus reality

“…Florencio and Herley (2007:657) found that the average computer user has 25 password-protected accounts. As the use of password-protected systems increases, the usability of the passwords decease as human memory limitations place a strain on the memory of computer users who have to remember their numerous passwords to access these systems (Chiasson & Biddle 2007:1;Egelman et al 2013). With more systems and services requiring users to identify and authenticate themselves online, the desire to select memorable passwords only increases as the number of passwords required increases.…”

“…With more systems and services requiring users to identify and authenticate themselves online, the desire to select memorable passwords only increases as the number of passwords required increases. Even more disconcerting is the enforced lifetime policies and composition characteristics that in isolation (user and system) leads to stronger passwords, but at user level often leads to multiple uses of the same password (Egelman et al 2013), thereby increasing risk. Notoatmodjo and Thomborson (2009:71) refer to computer users suffering from 'password overload' and suggest that this is a major contributor to unsafe password practices.…”