Passwords Are Not Always Stronger on the Other Side of the Fence

Abstract

The username-password pair is still a prevalent form of online authentication. However, attacks that are leveraging weak password habits are on the rise. The main response of the security community on the ground is to invest more in educating users. Such an approach leads to believe that the long held assumption stating that an ignorant user is the cause of an inadequate password behavior, still has many opponents. Although different research studies have presented other more likely reasons, practices are still perpetuating the same solution mindset of increasing end users' education. The behavior of users has not improved dramatically over the last decade despite all these efforts. Therefore, this research work explores the hypothesis that knowledge of good password habits is a necessary but not by itself a satisfactory requirement for a safe password behavior. This will be achieved by studying the password habits of the same people advocating for more end user education. To investigate this hypothesis, we conducted a survey targeting an audience of IT professionals with good knowledge about security. The survey results show that cognitive knowledge of password security does not always materialize into practical and secure password practices. The anticipated results would be that confronting IT professionals with their own password practices which fail to adhere to what they preach to end users, will motivate them to let go of their long held assumptions that more education is the solution. This will further support the points made by other studies explaining the rationale behind the inadequate password habits of end users. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Addressing misconceptions about password security effectively

“…M9 regards the handling of paper notes as well as electronic notes [15]. It was reported in three publications: [8,15,16]. The problem underlying this misconception is that notes of passwords can be beneficial and have been recommended by security experts (e.g.…”

Web Authentication using Third-Parties in Untrusted Environments

“…Users have been shown to be more well-educated about secure password practices than previously known, but will still select the path of least resistance if possible [21]. Even skilled users have been shown to apply insecure password practices, even if these users are aware of the risks, showing that usability often overshadows security for users [42].…”