Lessons Learned from Evaluating Eight Password Nudges in the Wild

Renaud, K., Zimmermann, V., Maguire, J. and Draper, S. (2017) Lessons Learned from Evaluating Eight Password Nudges in the Wild. In: The LASER Workshop: Learning from Authoritative Security Experiment Results, Arlington, VA, USA, 18-19 Oct 2017, pp. 25-37. ISBN 9781931971416

[img]
Preview
Text
153405.pdf - Published Version

544kB

Publisher's URL: https://www.usenix.org/conference/laser2017/presentation/renaud

Abstract

Background. The tension between security and convenience, when creating passwords, is well established. It is a tension that often leads users to create poor passwords. For security designers, three mitigation strategies exist: issuing passwords, mandating minimum strength levels or encouraging better passwords. The first strategy prompts recording, the second reuse, but the third merits further investigation. It seemed promising to explore whether users could be subtly nudged towards stronger passwords. Aim. The aim of the study was to investigate the influence of visual nudges on self-chosen password length and/or strength. Method. A university application, enabling students to check course dates and review grades, was used to support two consecutive empirical studies over the course of two academic years. In total, 497 and 776 participants, respectively, were randomly assigned either to a control or an experimental group. Whereas the control group received no intervention, the experimental groups were presented with different visual nudges on the registration page of the web application whenever passwords were created. The experimental groups’ password strengths and lengths were then compared that of the control group. Results. No impact of the visual nudges could be detected, neither in terms of password strength nor length. The ordinal score metric used to calculate password strength led to a decrease in variance and test power, so that the inability to detect an effect size does not definitively indicate that such an effect does not exist. Conclusion. We cannot conclude that the nudges had no effect on password strength. It might well be that an actual effect was not detected due to the experimental design choices. Another possible explanation for our result is that password choice is influenced by the user’s task, cognitive budget, goals and pre-existing routines. A simple visual nudge might not have the power to overcome these forces. Our lessons learned therefore recommend the use of a richer password strength quantification measure, and the acknowledgement of the user’s context, in future studies.

Item Type:Conference Proceedings
Keywords:Authentication, nudges.
Status:Published
Refereed:Yes
Glasgow Author(s) Enlighten ID:Renaud, Professor Karen and Draper, Dr Steve and Maguire, Dr Joseph
Authors: Renaud, K., Zimmermann, V., Maguire, J., and Draper, S.
Subjects:Q Science > Q Science (General)
T Technology > T Technology (General)
College/School:College of Science and Engineering > School of Computing Science
College of Science and Engineering > School of Psychology
ISBN:9781931971416
Copyright Holders:Copyright © 2017 The Authors
First Published:First published in The LASER Workshop: Learning from Authoritative Security Experiment Results: 25-37
Publisher Policy:Reproduced in accordance with the publisher copyright policy

University Staff: Request a correction | Enlighten Editors: Update this record