Perceptions of Risk, Benefits and Likelihood of Undertaking Password Management Behaviours: Four Components

Abstract

Passwords remain the most common form of authentication in the digital world. People have increasing numbers of passwords, and research suggests that many people undertake risky password management behaviours such as reusing passwords, writing them down and sharing them with friends and colleagues. It is not clear whether people persist in these behaviours because they do not understand the risks involved or the benefits of the behavior outweigh the risk. An online survey was undertaken with 120 MTurk workers in which they rated the risks, benefits and likelihood of undertaking 15 password management behaviours. They also completed the Marlow-Crowne Social Desirability Scale to investigate whether their responses, particularly of the likelihood ratings, were affected by social desirability. An interesting pattern of responses was found with some groups of behaviours more affected by perceptions of the benefits and others equally affected by the perceptions of the risks and the benefits. These results have implications for how information about risky password behaviours in presented to users and general education about password security.

Bingo: A Semi-Centralized Password Storage System

“…Rather than tackling compromised passwords through another form of authentication, Password aggregators such as LastPass aim to combat passwords that are easy to guess, as well as the reuse of passwords [17]. An aggregator requires that a user choose a "master password", which is then used to access a collection of all of the user's passwords for all online services.…”

Understanding Mental Models of Password Managers

“…(d) writing passwords down on a piece of paper (or sticky notes), storing files with passwords digitally on a device (smartphone or laptop) or in the cloud [24,39]; 9 (e) using single sign-on option (e.g., authorization on web sites with Facebook credentials); and…”

“…Passwords are the most common authentication method which gives access to users' online accounts, but they are also perceived as a barrier since remembering and managing them puts an additional burden on users [13,39,46]. This prompts people to find various coping strategies to overcome this inconvenience [16,24,44,49].…”

“…Security experts report the existence of various weak coping strategies among online users (such as password reuse, creating easy-to-guess passwords, or unprotected password storing) [6,24,39,46,49], while recommending other strategies that make password management secure. One important strategy is adoption of password managers, dedicated tools for securely creating, storing, and using passwords [12,20,42].…”

“…Passwords are still considered the most common online authentication method [6,16] even though the goal of finding another seamless yet secure authentication process has been a longstanding concern for over decades [6]. Due to the growing number of accounts and a limited number of items the human brain is able to remember, people tend to find different coping strategies to reduce memory overload and find convenient ways to manage their passwords [6,23,24,39,44,46]. Some strategies (such as password reuse) make user accounts vulnerable to guessing attacks [16,36,44].…”