Human-Generated and Machine-Generated Ratings of Password Strength: What Do Users Trust More?

Abstract

Proactive password checkers have been widely used to persuade users to select stronger passwords by providing machine-generated strength ratings of passwords. If such ratings do not match human-generated ratings of human users, there can be a loss of trust in PPCs. In order to study the effectiveness of PPCs, it would be useful to investigate how human users perceive such machine-and human-generated ratings in terms of their trust, which has been rarely studied in the literature. To fill this gap, we report a large-scale crowdsourcing study with over 1,000 workers. The participants were asked to choose which of the two ratings they trusted more. The passwords were selected based on a survey of over 100 human password experts. The results revealed that participants exhibited four distinct behavioral patterns when the passwords were hidden, and many changed their behaviors significantly after the passwords were disclosed, suggesting their reported trust was influenced by their own judgments.

Introducing a Machine Learning Password Metric Based on EFKM Clustering Algorithm

“…A common approach to evaluate a password in terms of its strength level is passwords rating. In [24] the authors categorized the techniques of the password strength rating into two major categories: 1-machine ratings and 2-human ratings. After that, they implemented a survey to measure how such ratings affect users' trust.…”

PassViz: An Interactive Visualisation System for Analysing Leaked Passwords

“…One source of the weak password problem is the conflict of security and usability of passwords: stronger passwords tend to be harder to remember, and easier-to-remember passwords tend to be easier to crack [16,18]. Human users tend to have different insecure behaviours around password creation, e.g., the mismatch between human users' misperception of a password's strength and its actual strength can lead to creation of weak passwords [1,18], and many users choose to reuse the same password across multiple accounts [12]. Such weak passwords have led to repeated leakage of passwords from many websites, including some very large-scale incidents.…”