Impact of restrictive composition policy on user password choices

Campbell, John; Ma, Wanli; Kleeman, Dale

doi:10.1080/0144929x.2010.492876

Cited by 40 publications

(27 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Such a policy might require that a password be at least eight characters long and contain both letters and digits. Researchers have found that password policies help users create passwords that are generally harder to crack than those created without composition requirements [11,25,32]. Unfortunately, users are frustrated by inflexible password-composition and password-management requirements [1,19], and they often fulfill requirements in predictable ways [9,28,33,35].…”

Section: Background and Related Workmentioning

confidence: 99%

Can long passwords be secure and usable?

Shay

Komanduri

Durity

et al. 2014

Proceedings of the SIGCHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

To encourage strong passwords, system administrators employ password-composition policies, such as a traditional policy requiring that passwords have at least 8 characters from 4 character classes and pass a dictionary check. Recent research has suggested, however, that policies requiring longer passwords with fewer additional requirements can be more usable and in some cases more secure than this traditional policy. To explore long passwords in more detail, we conducted an online experiment with 8,143 participants. Using a cracking algorithm modified for longer passwords, we evaluate eight policies across a variety of metrics for strength and usability. Among the longer policies, we discover new evidence for a security/usability tradeoff, with none being strictly better than another on both dimensions. However, several policies are both more usable and more secure that the traditional policy we tested. Our analyses additionally reveal common patterns and strings found in cracked passwords. We discuss how system administrators can use these results to improve password-composition policies.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Can long passwords be secure and usable?

Shay

Komanduri

Durity

et al. 2014

Proceedings of the SIGCHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

show abstract

“…anniversary dates, household telephone numbers) or nouns that are meaningful to the interviewees (Campbell et al, 2011). Other numbers which are worthy of note include the almanac shifting between the Christian era and the Republic era.…”

Section: Meaningful and Non-meaningful Number Or Nounmentioning

confidence: 99%

“…Given the flexibility, the chosen accounts and passwords reflect certain meaning that is significant to the users. This set of coding procedure will be seen as one that consists of special referents to people, matter, fact, location, things, and words that are either psychologically related to the applicants or can be commonly found in the dictionary (Campbell et al, 2011). Its initial intention is nothing but to help memorize the sometimes elusive accounts and passwords with the assistance of something referential to the users.…”

Section: Coding Process and Featurementioning

confidence: 99%

“…Therefore, developing the security authentication code is such an important work for controlling webmaster's management and supervising online users' usage to prevent initially hackers' attack (Singh & Thakur, 2012). In other words, authentication and verification are not only taken as the critical step to make legal access to the informational system but also a basic means to provide information security (Campbell, Ma, & Kleeman, 2011). Although accounts and passwords have become a necessity nowadays, many of online users establish their authentication code in a random manner for ease memory while never take the associated information security problems into account (Campbell et al, 2011;Weber, Guster, & Safonov, 2008).…”

Section: Introductionmentioning

confidence: 98%

“…In other words, authentication and verification are not only taken as the critical step to make legal access to the informational system but also a basic means to provide information security (Campbell, Ma, & Kleeman, 2011). Although accounts and passwords have become a necessity nowadays, many of online users establish their authentication code in a random manner for ease memory while never take the associated information security problems into account (Campbell et al, 2011;Weber, Guster, & Safonov, 2008). Meanwhile, a problem to arise here is that many website users often register different accounts and passwords in their applying for membership, and this it will end up with a notorious memory challenge to them (Bunnell, Podd, Henderson, Napier, & Kennedy-Moffat, 1997).…”

Section: Introductionmentioning

confidence: 98%

See 2 more Smart Citations

Coding behavior of authentication code on the internet

Lin

Yen

Chen

et al. 2013

Computers in Human Behavior

View full text Add to dashboard Cite

If it is easy to remember, then it is not secure: Metacognitive beliefs affect password selection

Luna

2019

Applied Cognitive Psychology

View full text Add to dashboard Cite

In this research, we applied current theories of metacognition to study computer security and tested the idea that users' password selection is affected by the metacognitive belief that if a password is memorable, then it is not secure. In two experiments, different types of eight-character passwords and longer, more secure sentences were presented. Participants rated perceived memorability and perceived security of the passwords and indicated whether they would use them in a critical and in a noncritical service. The results confirmed the belief. Sentences that are in fact highly secure and perceived as highly memorable were also perceived as weak passwords. The belief strongly affected password selection for critical services, but it had no effect on noncritical services. In sum, long sentences are a particularly interesting type of password because they meet both security and memorability criteria, but their use is limited by a false belief.

show abstract

Impact of restrictive composition policy on user password choices

Cited by 40 publications

References 28 publications

Can long passwords be secure and usable?

Can long passwords be secure and usable?

Coding behavior of authentication code on the internet

If it is easy to remember, then it is not secure: Metacognitive beliefs affect password selection

Contact Info

Product

Resources

About