Generational Differences in Password Management Behaviour

Passwords still remain a very common authentication method for online accounts. Many studies have investigated people’s risky password management behaviour, including reusing passwords, writing them down, and sharing them with others. However, most studies provide limited information about the demographics of their participants. There may be substantial differences in password management behaviour between younger and older people, as they represent very different generations with different experiences of the Internet, and investigation of these differences could be a first step to helping people manage their passwords more appropriately. An online survey asked 45 younger and 47 older people about their password management behaviour. Significant generational differences were found in password behaviours including storing passwords, sharing them with others, forgetting them, and logging in from a shared computer. There were also significant differences in respondents’ ratings of their password security knowledge and password strength. Finally, there was a significant social desirability bias in answers to several questions.

Content

Author and article information

Contributors

Burak Merdenyan

Helen Petrie

Conference

Publication date: July 2018

Publication date (Print): July 2018

Pages: 1-10

Affiliations

[1 ] University of York

York, United Kingdom

Article

DOI: 10.14236/ewic/HCI2018.60

SO-VID: 104d6173-5361-46f8-a598-caad67238c13

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: Proceedings of the 32nd International BCS Human Computer Interaction Conference

Conference acronym: HCI

Conference number: 32

Conference location: Belfast, UK

Conference date: 4 - 6 July 2018

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Human Computer Interaction Conference

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/HCI2018.60

Self URI (journal page): https://ewic.bcs.org/

REFERENCES

A. Adams & M.A. Sasse (1999). Users are not the enemy. Communications of the ACM, 42(12), pp. 40–46.
J. Bonneau, C. Herley, van P.C. Oorschot & F. Stajano (2015). Passwords and the evolution of imperfect authentication. Communications of the ACM, 58(7), pp. 78–87.
V. Boothroyd & S. Chiasson (2013, July). Writing down your password: Does it help? In Eleventh Annual International Conference on Privacy, Security and Trust (PST), 2013 (pp. 267–274). IEEE.
A.S. Brown, E. Bracken, S. Zoccoli & K. Douglas (2004). Generating and remembering passwords. Applied Cognitive Psychology, 18(6), pp. 641–651.
K. Bryant & J. Campbell (2006). User behaviors associated with password security and management. Australasian Journal of Information Systems 14(1), 81 - 100.
S. T. Charles, C. A. Reynolds & M. Gatz (2001). Age-related differences and change in positive and negative affect over 23 years. Journal of Personality and Social Psychology, 80(1), 136.
A. Das, J. Bonneau, M. Caesar, N. Borisov & X. Wang (2014, February). The Tangled Web of Password Reuse? In NDSS (Vol. 14, pp. 23–26).
D. Florencio & C. Herley (2007, May). A large-scale study of web password habits? In Proceedings of the 16th international conference on World Wide Web (pp. 657–666). ACM.
S. Fox & M. Madden (2006). Generations online (demographic report). Pew Internet & American Life Project.
S. Furnell & N. Bär L. MarinosI. Askoxylakis (2013). Essential lessons still not learned? Examining the password practices of end-users and service providers HAS/HCII 2013. LNCS 8030. (pp. 217 – 225). Springer.
S. Gaw & E.W. Felten (2006, July). Password management strategies for online accounts? In Proceedings of the Second Symposium on Usable privacy and security (pp. 44–55). ACM.
B. Grawemeyer & H. Johnson (2011). Using and managing multiple passwords: A week to a view. Interacting with Computers, 23(3), pp. 256–267.In Proceedings of the Sixth Symposium on Usable Privacy and Security (p. 2). ACM.
J. J. Gross, L. L. Carstensen, M. Pasupathi, J. Tsai, C. Götestam Skorpen & A. Y. Hsu (1997). Emotion and aging: Experience, expression, and control. Psychology and Aging, 12(4), 590.
P. Hoonakker, N. Bornoe & P. Carayon (2009). Password authentication from a human factors perspective: results of a survey among end-users? In Proceedings of the Human Factors and Ergonomics Society 53rd Annual Meeting. HF&E Society.
P.G. Inglesant & M.A. Sasse (2010, April). The true cost of unusable password policies: password use in the wild? In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 383–392). ACM.
J. Kaye (2011). Self-reported password sharing strategies? In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 2619 - 2622). ACM.
N. Kumar (2011). Password in practice: an usability study. Journal of Global Research in Computer Science, 2(5), 107–112.
D.J. Meter & S. Bauman (2015). When sharing is a bad idea: the effects of online social network engagement and sharing passwords with friends on cyberbullying involvement. Cyberpsychology, Behavior, and Social Networking, 18(8), 437–442.
G. Notoatmodjo & C. Thomborson (2009). Passwords and perceptions? In Proceedings of the 7th Australasian Information Security Conference (AISC 2009). Australian Computer Society.
H. Petrie & B. Merdenyan (2016, October). Cultural and Gender Differences in Password Behaviors: Evidence from China, Turkey and the UK. In Proceedings of the 9th Nordic Conference on Human-Computer Interaction. ACM.
S. Riley (2006). Password security: What users know and what they actually do. Usability News, 8(1), 2833–2836.
T. Seitz, M. Hartmann, J. Pfab & S. Souque (2017, May). Do Differences in Password Policies Prevent Password Reuse?? In Proceedings of the 2017 CHI Conference Extended Abstracts on Human Factors in Computing Systems (pp. 2056–2063). ACM.
R. Shay, S. Komanduri, P.G. Kelley, P.G. Leon, M.L. Mazurek, L. Bauer, N. Christin & L.F. Cranor 2010, July Encountering stronger password requirements: user attitudes and behaviors. Symposium on Usable Privacy and Security (SOUPS). ACM.
S. Singh, A. Cabraal, C. Demosthenous, G. Astbrink & M. Furlong (2007, April). Password sharing: implications for security design based on social practice? In Proceedings of the SIGCHI conference on Human factors in computing systems (pp. 895–904). ACM.
A. Soubelet & T. A. Salthouse (2011). Influence of social desirability on age differences in self‐reports of mood and personality. Journal of Personality, 79(4), 741–762.
E. Stobert & R. Biddle (2014, July). The password life cycle: user behaviour in managing passwords? In Symposium on Usable Privacy and Security (SOUPS). ACM.
R. Strahan & K. C. Gerbasi (1972). Short, homogeneous versions of the Marlow‐Crowne Social Desirability Scale. Journal of Clinical Psychology, 28(2), 191–193.
L. TamM. Glassman & M. Vandenwauver (2010). The psychology of password management: a tradeoff between security and convenience. Behaviour and Information Technology, 29(3), 233–244.
B. A. Teachman (2006). Aging and negative affect: the rise and fall and rise of anxiety and depression symptoms. Psychology and Aging, 21(1), 201.
B. Ur, F. Noma, J. Bees, S. M. Segreti, R. Shay, L. Bauer, N. Christin & L. F. Cranor (2015, July). “I added „!‟ at the end to make it secure”: Observing password creation in the lab? In Symposium on Usable Privacy and Security (SOUPS). ACM.
A. J. Van Deursen & J. A. Van Dijk (2014). The digital divide shifts to differences in usage. New Media & Society, 16(3), 507–526.
M. Whitty, J. Doodson, S. Creese & D. Hodges (2015). Individual differences in cyber security behaviors: an examination of who is sharing passwords. Cyberpsychology, Behaviour, and Social Networking, 18(1), 3–7.
N. Woods & M. Siponen (2018). Too many passwords? How understanding our memory can increase password memorability. International Journal of Human-Computer Studies, 111, 36–48.
N. Zillien & E. Hargittai (2009). Digital distinction: Status‐specific types of internet usage. Social Science Quarterly, 90(2), 274–291.
M. Zviran & W.J. Haga (1999). Password security: an empirical study. Journal of Management Information Systems, 15(4), pp. 161–185.

Comments

Comment on this article

[1] A. Adams & M.A. Sasse (1999). Users are not the enemy. Communications of the ACM, 42(12), pp. 40–46.

[2] J. Bonneau, C. Herley, van P.C. Oorschot & F. Stajano (2015). Passwords and the evolution of imperfect authentication. Communications of the ACM, 58(7), pp. 78–87.

[3] V. Boothroyd & S. Chiasson (2013, July). Writing down your password: Does it help? In Eleventh Annual International Conference on Privacy, Security and Trust (PST), 2013 (pp. 267–274). IEEE.

[4] A.S. Brown, E. Bracken, S. Zoccoli & K. Douglas (2004). Generating and remembering passwords. Applied Cognitive Psychology, 18(6), pp. 641–651.

[5] K. Bryant & J. Campbell (2006). User behaviors associated with password security and management. Australasian Journal of Information Systems 14(1), 81 - 100.

[6] S. T. Charles, C. A. Reynolds & M. Gatz (2001). Age-related differences and change in positive and negative affect over 23 years. Journal of Personality and Social Psychology, 80(1), 136.

[7] A. Das, J. Bonneau, M. Caesar, N. Borisov & X. Wang (2014, February). The Tangled Web of Password Reuse? In NDSS (Vol. 14, pp. 23–26).

[8] D. Florencio & C. Herley (2007, May). A large-scale study of web password habits? In Proceedings of the 16th international conference on World Wide Web (pp. 657–666). ACM.

[9] S. Fox & M. Madden (2006). Generations online (demographic report). Pew Internet & American Life Project.

[10] S. Furnell & N. Bär L. MarinosI. Askoxylakis (2013). Essential lessons still not learned? Examining the password practices of end-users and service providers HAS/HCII 2013. LNCS 8030. (pp. 217 – 225). Springer.

[11] S. Gaw & E.W. Felten (2006, July). Password management strategies for online accounts? In Proceedings of the Second Symposium on Usable privacy and security (pp. 44–55). ACM.

[12] B. Grawemeyer & H. Johnson (2011). Using and managing multiple passwords: A week to a view. Interacting with Computers, 23(3), pp. 256–267.In Proceedings of the Sixth Symposium on Usable Privacy and Security (p. 2). ACM.

[13] J. J. Gross, L. L. Carstensen, M. Pasupathi, J. Tsai, C. Götestam Skorpen & A. Y. Hsu (1997). Emotion and aging: Experience, expression, and control. Psychology and Aging, 12(4), 590.

[14] P. Hoonakker, N. Bornoe & P. Carayon (2009). Password authentication from a human factors perspective: results of a survey among end-users? In Proceedings of the Human Factors and Ergonomics Society 53rd Annual Meeting. HF&E Society.

[15] P.G. Inglesant & M.A. Sasse (2010, April). The true cost of unusable password policies: password use in the wild? In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 383–392). ACM.

[16] J. Kaye (2011). Self-reported password sharing strategies? In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 2619 - 2622). ACM.

[17] N. Kumar (2011). Password in practice: an usability study. Journal of Global Research in Computer Science, 2(5), 107–112.

[18] D.J. Meter & S. Bauman (2015). When sharing is a bad idea: the effects of online social network engagement and sharing passwords with friends on cyberbullying involvement. Cyberpsychology, Behavior, and Social Networking, 18(8), 437–442.

[19] G. Notoatmodjo & C. Thomborson (2009). Passwords and perceptions? In Proceedings of the 7th Australasian Information Security Conference (AISC 2009). Australian Computer Society.

[20] H. Petrie & B. Merdenyan (2016, October). Cultural and Gender Differences in Password Behaviors: Evidence from China, Turkey and the UK. In Proceedings of the 9th Nordic Conference on Human-Computer Interaction. ACM.

[21] S. Riley (2006). Password security: What users know and what they actually do. Usability News, 8(1), 2833–2836.

[22] T. Seitz, M. Hartmann, J. Pfab & S. Souque (2017, May). Do Differences in Password Policies Prevent Password Reuse?? In Proceedings of the 2017 CHI Conference Extended Abstracts on Human Factors in Computing Systems (pp. 2056–2063). ACM.

[23] R. Shay, S. Komanduri, P.G. Kelley, P.G. Leon, M.L. Mazurek, L. Bauer, N. Christin & L.F. Cranor 2010, July Encountering stronger password requirements: user attitudes and behaviors. Symposium on Usable Privacy and Security (SOUPS). ACM.

[24] S. Singh, A. Cabraal, C. Demosthenous, G. Astbrink & M. Furlong (2007, April). Password sharing: implications for security design based on social practice? In Proceedings of the SIGCHI conference on Human factors in computing systems (pp. 895–904). ACM.

[25] A. Soubelet & T. A. Salthouse (2011). Influence of social desirability on age differences in self‐reports of mood and personality. Journal of Personality, 79(4), 741–762.

[26] E. Stobert & R. Biddle (2014, July). The password life cycle: user behaviour in managing passwords? In Symposium on Usable Privacy and Security (SOUPS). ACM.

[27] R. Strahan & K. C. Gerbasi (1972). Short, homogeneous versions of the Marlow‐Crowne Social Desirability Scale. Journal of Clinical Psychology, 28(2), 191–193.

[28] L. TamM. Glassman & M. Vandenwauver (2010). The psychology of password management: a tradeoff between security and convenience. Behaviour and Information Technology, 29(3), 233–244.

[29] B. A. Teachman (2006). Aging and negative affect: the rise and fall and rise of anxiety and depression symptoms. Psychology and Aging, 21(1), 201.

[30] B. Ur, F. Noma, J. Bees, S. M. Segreti, R. Shay, L. Bauer, N. Christin & L. F. Cranor (2015, July). “I added „!‟ at the end to make it secure”: Observing password creation in the lab? In Symposium on Usable Privacy and Security (SOUPS). ACM.

[31] A. J. Van Deursen & J. A. Van Dijk (2014). The digital divide shifts to differences in usage. New Media & Society, 16(3), 507–526.

[32] M. Whitty, J. Doodson, S. Creese & D. Hodges (2015). Individual differences in cyber security behaviors: an examination of who is sharing passwords. Cyberpsychology, Behaviour, and Social Networking, 18(1), 3–7.

[33] N. Woods & M. Siponen (2018). Too many passwords? How understanding our memory can increase password memorability. International Journal of Human-Computer Studies, 111, 36–48.

[34] N. Zillien & E. Hargittai (2009). Digital distinction: Status‐specific types of internet usage. Social Science Quarterly, 90(2), 274–291.

[35] M. Zviran & W.J. Haga (1999). Password security: an empirical study. Journal of Management Information Systems, 15(4), pp. 161–185.

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65