Perceptions of the risks of password related activities

Many studies have investigated people’s risky password related activities such as writing down passwords, sharing them with other people and re-using them across accounts, but few studies have investigated people’s perceptions of the risks of these activities. This paper reports on an online survey with 129 people rating the risks of 11 different password related activities in four domains (social networking, email, eBanking and eCommerce). There were fewer differences between the perceived riskiness of activities due to domain than expected, but differences between the activities and the numbers of respondents who said they would engage in the different activities. There were interesting patterns of differences in the ratings of the riskiness, severity of the consequences, usefulness and likelihood of encountering the different activities, which may help explain why people undertake risky password activities.

Content

Author and article information

Contributors

Burak Merdenyan

Helen Petrie

Conference

Publication date: July 2017

Publication date (Print): July 2017

Pages: 1-10

Affiliations

[0001]Human Computer Interaction Research Group

Department of Computer Science

University of York

York YO10 5GH UK

Article

DOI: 10.14236/ewic/HCI2017.54

SO-VID: 186768b7-005e-4c69-af2c-5d35235e7846

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: Electronic Visualisation and the Arts (EVA 2017)

Conference acronym: EVA

Conference number:

Conference location: London, UK

Conference date: 11 – 13 July 2017

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Electronic Visualisation and the Arts

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/HCI2017.54

Self URI (journal page): https://ewic.bcs.org/

References

A. AdamsM.A. Sasse 1999 Users are not the enemy Communications of the ACM 42 12 40 46
A. AdamsM.A. SasseP. Lunt 1997 Making passwords secure and usable People and Computers XII 1 19 Springer London
J. BonneauC. HerleyP.C. van OorschotF. Stajano 2015 Passwords and the evolution of imperfect authentication Communications of the ACM 58 7 78 87
V. BoothroydS. Chiasson 2013 July Writing down your password: Does it help Privacy, Security and Trust (PST), 2013 Eleventh Annual International Conference 267 274 IEEE
G.M. Breakwell 2014 The psychology of risk Cambridge University Press
A.S. BrownE. BrackenS. ZoccoliK. Douglas 2004 Generating and remembering passwords Applied Cognitive Psychology 18 6 641 651
K. BryantJ. Campbell 2006 User behaviours associated with password security and management Australasian Journal of Information Systems 14 1
S. CreeseD. HodgesS. Jamison-PowellM. Whitty 2013 July Relationships between password choices, perceptions of risk and security expertise International Conference on Human Aspects of Information Security, Privacy, and Trust 80 89 Springer Berlin Heidelberg
S. EgelmanA. SotirakopoulosI. MuslukhovK. BeznosovC. Herley 2013 April Does my password go up to eleven?: the impact of password meters on password selection Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 2379 2388 ACM
B. FischhoffP. SlovicS. LichtensteinS. ReadB. Combs 1978 How safe is safe enough? A psychometric study of attitudes towards technological risks and benefits Policy sciences 9 2 127 152
D. FlorencioC. Herley 2007 May A large-scale study of web password habits Proceedings of the 16th international conference on World Wide Web 657 666 ACM
S. GawE.W. Felten 2006 July Password management strategies for online accounts Proceedings of the second symposium on Usable privacy and security 44 55 ACM
B. GrawemeyerH. Johnson 2011 Using and managing multiple passwords: A week to a view Interacting with Computers 23 3 256 267
P.G. InglesantM.A. Sasse 2010 April The true cost of unusable password policies: password use in the wild Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 383 392 ACM
J.J. Kaye 2011 May Self-reported password sharing strategies Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 2619 2622 ACM
S. KomanduriR. ShayP.G. KelleyM.L. MazurekL. BauerN. ChristinL.F. CranorS. Egelman 2011 May Of passwords and people: measuring the effect of password-composition policies Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 2595 2604 ACM
N. Kumar 2011 Password in practice: An usability survey Journal of Global Research in Computer Science 2 5 107 112
E.J. Langer 1975 The illusion of control Journal of Personality and Social Psychology 32 2 311
M.L. MazurekS. KomanduriT. VidasL. BauerN. ChristinL.F. CranorP.G. KelleyR. ShayB. Ur 2013 November Measuring password guessability for an entire university Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security 173 186 ACM
D.J. MeterS. Bauman 2015 When sharing is a bad idea: the effects of online social network engagement and sharing passwords with friends on cyberbullying involvement Cyberpsychology, Behavior, and Social Networking 18 8 437 442
R. MorrisK. Thompson 1979 Password security: A case history Communications of the ACM 22 11 594 597
H. PetrieB. Merdenyan 2016 October Cultural and Gender Differences in Password Behaviors: Evidence from China, Turkey and the UK Proceedings of the 9th Nordic Conference on Human-Computer Interaction 9 ACM
R.W. ProctorM.C. LienK.P.L. VuE.E. SchultzG. Salvendy 2002 Improving computer security for authentication of users: Influence of proactive password restrictions Behavior Research Methods, Instruments, & Computers 34 2 163 169
M.A. SasseS. BrostoffD. Weirich 2001 Transforming the ‘weakest link’—a human/computer interaction approach to usable and effective security BT Technology Journal, 19 3 122 131
R. ShayS. KomanduriP.G. KelleyP.G. LeonM.L. MazurekL. BauerN. ChristinL.F. Cranor 2010 July Encountering stronger password requirements: user attitudes and behaviors Proceedings of the Sixth Symposium on Usable Privacy and Security 2 ACM
S. SinghA. CabraalC. DemosthenousG. AstbrinkM. Furlong 2007 April Password sharing: implications for security design based on social practice Proceedings of the SIGCHI conference on Human factors in computing systems 895 904 ACM
L. SjöbergB.E. MoenT. Rundmo 2004 Explaining risk perception An evaluation of the psychometric paradigm in risk perception research 33
P. Slovic 1986 Informing and educating the public about risk Risk analysis 6 4 403 415
P. Slovic 2016 The perception of risk Routledge
F.D. Sowby 1965 Radiation and Other Risks Health Physics 11 9 879 887
C. Starr 1969 Social benefit versus technological risk. Readings in Risk 183 194
E. StobertR. Biddle 2014 July The password life cycle: user behaviour in managing passwords Proc. SOUPS
B. UrJ. BeesS.M. SegretiL. BauerN. ChristinL.F. Cranor 2016 May Do Users' Perceptions of Password Security Match Reality Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems 3748 3760 ACM
B. UrP.G. KelleyS. KomanduriJ. LeeM. MaassM.L. MazurekT. PassaroR. ShayT. VidasL. BauerN. Christin 2012 August How does your password measure up? The effect of strength meters on password creation USENIX Security Symposium 65 80
A.G. VoyiatzisC.A. FidasD.N. SerpanosN.M. Avouris 2011 September An empirical study on the web password strength in greece Informatics (PCI), 2011 15th Panhellenic Conference on 212 216 IEEE
K.P.L. VuR.W. ProctorA. Bhargav-SpantzelB.L.B. TaiJ. CookE.E. Schultz 2007 Improving password security and memorability to protect personal and organizational information International Journal of HumanComputer Studies 65 8 744 757
M. WhittyJ. DoodsonS. CreeseD. Hodges 2015 Individual differences in cyber security behaviors: an examination of who is sharing passwords Cyberpsychology, Behavior, and Social Networking 18 1 3 7
J. YanA. BlackwellR. AndersonA. Grant 2004 Password memorability and security: Empirical results IEEE Security &Pprivacy 2 5 25 31
M. ZviranW.J. Haga 1999 Password security: an empirical study Journal of Management Information Systems 15 4 161 185

Comments

Comment on this article

[1] A. AdamsM.A. Sasse 1999 Users are not the enemy Communications of the ACM 42 12 40 46

[2] A. AdamsM.A. SasseP. Lunt 1997 Making passwords secure and usable People and Computers XII 1 19 Springer London

[3] J. BonneauC. HerleyP.C. van OorschotF. Stajano 2015 Passwords and the evolution of imperfect authentication Communications of the ACM 58 7 78 87

[4] V. BoothroydS. Chiasson 2013 July Writing down your password: Does it help Privacy, Security and Trust (PST), 2013 Eleventh Annual International Conference 267 274 IEEE

[5] G.M. Breakwell 2014 The psychology of risk Cambridge University Press

[6] A.S. BrownE. BrackenS. ZoccoliK. Douglas 2004 Generating and remembering passwords Applied Cognitive Psychology 18 6 641 651

[7] K. BryantJ. Campbell 2006 User behaviours associated with password security and management Australasian Journal of Information Systems 14 1

[8] S. CreeseD. HodgesS. Jamison-PowellM. Whitty 2013 July Relationships between password choices, perceptions of risk and security expertise International Conference on Human Aspects of Information Security, Privacy, and Trust 80 89 Springer Berlin Heidelberg

[9] S. EgelmanA. SotirakopoulosI. MuslukhovK. BeznosovC. Herley 2013 April Does my password go up to eleven?: the impact of password meters on password selection Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 2379 2388 ACM

[10] B. FischhoffP. SlovicS. LichtensteinS. ReadB. Combs 1978 How safe is safe enough? A psychometric study of attitudes towards technological risks and benefits Policy sciences 9 2 127 152

[11] D. FlorencioC. Herley 2007 May A large-scale study of web password habits Proceedings of the 16th international conference on World Wide Web 657 666 ACM

[12] S. GawE.W. Felten 2006 July Password management strategies for online accounts Proceedings of the second symposium on Usable privacy and security 44 55 ACM

[13] B. GrawemeyerH. Johnson 2011 Using and managing multiple passwords: A week to a view Interacting with Computers 23 3 256 267

[14] P.G. InglesantM.A. Sasse 2010 April The true cost of unusable password policies: password use in the wild Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 383 392 ACM

[15] J.J. Kaye 2011 May Self-reported password sharing strategies Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 2619 2622 ACM

[16] S. KomanduriR. ShayP.G. KelleyM.L. MazurekL. BauerN. ChristinL.F. CranorS. Egelman 2011 May Of passwords and people: measuring the effect of password-composition policies Proceedings of the SIGCHI Conference on Human Factors in Computing Systems 2595 2604 ACM

[17] N. Kumar 2011 Password in practice: An usability survey Journal of Global Research in Computer Science 2 5 107 112

[18] E.J. Langer 1975 The illusion of control Journal of Personality and Social Psychology 32 2 311

[19] M.L. MazurekS. KomanduriT. VidasL. BauerN. ChristinL.F. CranorP.G. KelleyR. ShayB. Ur 2013 November Measuring password guessability for an entire university Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security 173 186 ACM

[20] D.J. MeterS. Bauman 2015 When sharing is a bad idea: the effects of online social network engagement and sharing passwords with friends on cyberbullying involvement Cyberpsychology, Behavior, and Social Networking 18 8 437 442

[21] R. MorrisK. Thompson 1979 Password security: A case history Communications of the ACM 22 11 594 597

[22] H. PetrieB. Merdenyan 2016 October Cultural and Gender Differences in Password Behaviors: Evidence from China, Turkey and the UK Proceedings of the 9th Nordic Conference on Human-Computer Interaction 9 ACM

[23] R.W. ProctorM.C. LienK.P.L. VuE.E. SchultzG. Salvendy 2002 Improving computer security for authentication of users: Influence of proactive password restrictions Behavior Research Methods, Instruments, & Computers 34 2 163 169

[24] M.A. SasseS. BrostoffD. Weirich 2001 Transforming the ‘weakest link’—a human/computer interaction approach to usable and effective security BT Technology Journal, 19 3 122 131

[25] R. ShayS. KomanduriP.G. KelleyP.G. LeonM.L. MazurekL. BauerN. ChristinL.F. Cranor 2010 July Encountering stronger password requirements: user attitudes and behaviors Proceedings of the Sixth Symposium on Usable Privacy and Security 2 ACM

[26] S. SinghA. CabraalC. DemosthenousG. AstbrinkM. Furlong 2007 April Password sharing: implications for security design based on social practice Proceedings of the SIGCHI conference on Human factors in computing systems 895 904 ACM

[27] L. SjöbergB.E. MoenT. Rundmo 2004 Explaining risk perception An evaluation of the psychometric paradigm in risk perception research 33

[28] P. Slovic 1986 Informing and educating the public about risk Risk analysis 6 4 403 415

[29] P. Slovic 2016 The perception of risk Routledge

[30] F.D. Sowby 1965 Radiation and Other Risks Health Physics 11 9 879 887

[31] C. Starr 1969 Social benefit versus technological risk. Readings in Risk 183 194

[32] E. StobertR. Biddle 2014 July The password life cycle: user behaviour in managing passwords Proc. SOUPS

[33] B. UrJ. BeesS.M. SegretiL. BauerN. ChristinL.F. Cranor 2016 May Do Users' Perceptions of Password Security Match Reality Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems 3748 3760 ACM

[34] B. UrP.G. KelleyS. KomanduriJ. LeeM. MaassM.L. MazurekT. PassaroR. ShayT. VidasL. BauerN. Christin 2012 August How does your password measure up? The effect of strength meters on password creation USENIX Security Symposium 65 80

[35] A.G. VoyiatzisC.A. FidasD.N. SerpanosN.M. Avouris 2011 September An empirical study on the web password strength in greece Informatics (PCI), 2011 15th Panhellenic Conference on 212 216 IEEE

[36] K.P.L. VuR.W. ProctorA. Bhargav-SpantzelB.L.B. TaiJ. CookE.E. Schultz 2007 Improving password security and memorability to protect personal and organizational information International Journal of HumanComputer Studies 65 8 744 757

[37] M. WhittyJ. DoodsonS. CreeseD. Hodges 2015 Individual differences in cyber security behaviors: an examination of who is sharing passwords Cyberpsychology, Behavior, and Social Networking 18 1 3 7

[38] J. YanA. BlackwellR. AndersonA. Grant 2004 Password memorability and security: Empirical results IEEE Security &Pprivacy 2 5 25 31

[39] M. ZviranW.J. Haga 1999 Password security: an empirical study Journal of Management Information Systems 15 4 161 185

Studying business & IT? Drive your professional career forwards with BCS books - for a 20% discount click here: shop.bcs.org