Understanding passwords – a taxonomy of password creation strategies

Abstract

Purpose Using authentication to secure data and accounts has grown to be a natural part of computing. Even if several authentication methods are in existence, using passwords remains the most common type of authentication. As long and complex passwords are encouraged by research studies and practitioners alike, computer users design passwords using strategies that enable them to remember their passwords. This paper aims to present a taxonomy of those password creation strategies in the form of a model describing various strategies used to create passwords. Design/methodology/approach The study was conducted in a three-step process beginning with a short survey among forensic experts within the Swedish police. The model was then developed by a series of iterative semi-structured interviews with forensic experts. In the third and final step, the model was validated on 5,000 passwords gathered from 50 different password databases that have leaked to the internet. Findings The result of this study is a taxonomy of password creation strategies presented as a model that describes the strategies as properties that a password can hold. Any given password can be classified as holding one or more of the properties outlined in the model. Originality/value On an abstract level, this study provides insight into password creation strategies. As such, the model can be used as a tool for research and education. It can also be used by practitioners in, for instance, penetration testing to map the most used password creation strategies in a domain or by forensic experts when designing dictionary attacks.

Constructing secure and memorable passwords

“…The overall aim of this study was to identify ways for users to create passwords that are computationally secure and easy to remember. First, the password creation strategies suggested by Kävrestad et al (2019) were analyzed to identify the strategies that support the creation of memorable passwords. While there is no comprehensive study conducted with the aim of analyzing the memory aspect of all possible password creations strategies, there is a lot of literature available on the topic.…”

“…The password creation strategies taken into account in this study are based on Kävrestad et al (2019), which describes the following password creation strategies: User-generated passwords, which are passwords created by a user. System-generated passwords, which are passwords generated by the software.…”

“…The purpose of this paper was to research methods for the creation of passwords that are usable and computationally secure by identifying cognitive password creation strategies that can be used to create memorable passwords that are also computationally secure. The paper users the password creation strategies listed by Kävrestad et al (2019) and has not considered any other possible password creation strategies. Should any new cognitive password creation strategies arise, the methodology applied in this paper could be applied to that strategy to evaluate the new strategies against the strategies evaluated in this paper.…”

“…The purpose of this study is to meet the problem just described by looking for cognitive password creation strategies that can be used to create memorable passwords that are also computationally secure. The different password creation strategies described by Kävrestad et al (2019) are taken into consideration in this study. First, a structured literature review is performed to identify the strategies that can help users create memorable passwords.…”

Assisting Users to Create Stronger Passwords Using ContextBased MicroTraining

“…As our dependence on digital services increases so does our need for information security, and a key aspect of information security is security behavior including the ability to select good passwords to protect our social media accounts, work accounts, encrypted data and more. However, there is a wealth of papers demonstrating that users tend to select passwords that are easy to guess for an attacker [1][2][3]. Practitioners, as well as researchers, continuously try to find ways to make users select good passwords, by enforcing complexity rules or using different support systems [4,5].…”