Password Management Strategies for Online Accounts (2006)
| Venue: | Proc. SOUPS 2006, ACM Press |
| Citations: | 89 - 0 self |
BibTeX
@INPROCEEDINGS{Gaw06passwordmanagement,
author = {Shirley Gaw},
title = {Password Management Strategies for Online Accounts},
booktitle = {Proc. SOUPS 2006, ACM Press},
year = {2006},
pages = {44--55},
publisher = {ACM Press}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Given the widespread use of password authentication in online correspondence, subscription services, and shopping, there is growing concern about identity theft. When people reuse their passwords across multiple accounts, they increase their vulnerability; compromising one password can help an attacker take over several accounts. Our study of 49 undergraduates quantifies how many passwords they had and how often they reused these passwords. The majority of users had three or fewer passwords and passwords were reused twice. Furthermore, over time, password reuse rates increased because people accumulated more accounts but did not create more passwords. Users justified their habits. While they wanted to protect financial data and personal communication, reusing passwords made passwords easier to manage. Users visualized threats from human attackers, particularly viewing those close to them as the most motivated and able attackers; however, participants did not separate the human attackers from their potentially automated tools. They sometimes failed to realize that personalized passwords such as phone numbers can be cracked given a large enough dictionary and enough tries. We discuss how current systems support poor password practices. We also present potential changes in website authentication systems and password managers.
Keyphrases
online account password management strategy human attacker financial data subscription service attacker take many password identity theft online correspondence widespread use multiple account website authentication system phone number able attacker several account personal communication password reuse rate large enough dictionary password authentication enough try potential change personalized password password manager
