Exploring mental models underlying PIN management strategies

Abstract

PINs have been around for half a century and many insecure PIN-related practices are used. We attempted to mitigate by developing two new PIN memorial assistance mechanisms that we tested in an online study. We were not able to show an improvement in memorability, mostly because people did not use the memorial aids. We realised that a greater insight into PIN Management mental models was needed, in order the better to formulate mitigation approaches. We proceeded to study PINrelated mental models, and we present our findings in this paper. The insights we gained convinced us that security researchers should not presume that people want, or need, our advice or help in any security context; they might well prefer to continue with their usual trusted practices. Yet advice should indeed still be offered, for those who do want it, and we make some suggestions about what this advice should look like in the PIN context.

Nudging Bank Account Holders Towards More Secure PIN Management

“…Roughly 50% of the participants stated that they would not be influenced by the leaflet in terms of their usual approach to handling new PINs. This is in line with findings by Renaud and Volkamer [3] that some people are less open to advice in general. This might be because they are satisfied with their current approach.…”

“…The idea is that banks would issue the leaflet together with new PINs. We started with a leaflet based on the work of Renaud and Volkamer [3] outlined in Section 3. We evaluated it in an online user study.…”

“…Renaud and Volkamer [3] outlined the mental models underlying the behaviours of bank customers with respect to PIN management. Based on this insight, they suggested advice that banks could provide to their customers when issuing a new PIN in order to encourage more secure retention.…”

“…Participants do record their PINs despite this practice being proscribed by most banks [3,8]. When it is clear that a behaviour cannot be feasibly forbidden, other strategies need to be considered.…”

Widely Reused and Shared, Infrequently Updated, and Sometimes Inherited: A Holistic View of PIN Authentication in Digital Lives and Beyond

“…Renaud and Volkamer [40] conducted an online study to evaluate two PIN memorization assistance techniques. While they reported no improvements in PIN memorization due to the users not using the memorization aids, they reported on the strategies people adopted for PIN memorization and whether participants wrote down their PINs.…”