Effects of peer feedback on password strength

Abstract

Effects of Peer Feedback on Password Strength Faisal Irfan Yar KhanChair of the Supervisory Committee:Dr. Marc Dupuis Computing and Software Systems This thesis is a study on the effects of peer-feedback on a user's password strength. Passwords are a common sight in everyday use of an average end user. Text-based passwords are heavily relied upon when it comes to user authentication employed in various account management scenarios. Most users do not pay attention to or understand the importance of creating a secure password. Lack of strong passwords means that it is the single most vulnerable point to gain unauthorized access to the resource as prior studies have uncovered that most passwords are significantly weak and hence, easy to crack. Consequently, exploring mechanisms which improve password security has been the main focus of a significant body of research. To this end, we introduced a peer-feedback password meter which shows how the strength of the user's password compares to the strength of passwords used by other users. To achieve this goal, we conducted a user study where we asked users to create an account on a hypothetical website. The users were either shown a traditional password meter or a peer-feedback meter. Our findings suggest that when told to create a unique password, the peer-feedback password meter significantly increased the strength of the password as compared to a traditional password meter.This approach could potentially be one of the methods to encourage end users to create a stronger password.i

Do You See What I See?

“…Adding color as an option for passwords, Gao and company generated the ColorLogin schema [8]. ColorLogin allows configuration for the number of rounds (1-3), a number of colors (3)(4)(5), and some password icons. A group of pictures arranged in 3 x 3 squares create a 9 x 9 over-all group of icons in each round.…”

“…The design goal should be to improve both security and usability rather than trading off one for the other [1]. Although various efforts have been undertaken to encourage the user to create more complex passwords using traditional text-based entry (e.g., [5]), the ability to remember and effectively recall such complex passwords remains problematic. And given that less than one-third of individuals use a password manager [4], we need to continue to explore other possible solutions.…”

The Nudge Puzzle

“…The most frequently used interventions are password meters that provide users with feedback on password strength and apply nudges within the design of the instruction or the feedback. For example, Ur et al varied the design of the feedback bar [88] and provided textual feedback based on the user's actual input [87], Vance et al [89] used fear appeals to increase the users' motivation, and Dupuis and Khan [30] as well as Ohyama and Kanaoka [59] made use of social influence to increase password strength. Renaud and Zimmermann deployed a number of images to encourage users to choose stronger passwords, e.g., a pair of watching eyes to activate social norms or an image of a long sausage dog to make the association between password length and strength more salient [73].…”

“…Deception nudges might make use of placebos or deceptive visualizations while social influence nudges make use of social norms and social comparisons to encourage a certain choice. Consider, for example, the password meter using peer feedback to increase password strength [30]. A reinforcing nudge could be a just-in-time prompt such as a notification shown as people are selecting privacy settings on their smartphones.…”

Conducting "In-Person" Research During a Pandemic

“…The number of participants planned for the original study was approximately 400. Recruitment was going to be done through flyers around two university campuses since past experience indicated this approach would be successful (e.g., [1]).…”