Why we hate IT: two surveys on pre‐generated and expiring passwords in an academic setting. Issue 13 (10th February 2015)

• Record Type: Journal Article
• Authors: Farcasin, Michael; Chan‐tin, Eric
• Is Part Of: Security and communication networks. Volume 8:Issue 13(2015)
• Page Start: 2361
• Page End: 2373
• Publication Date: 2015-02-10
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1184
• Languages: English
• ISSNs: 1939-0114

Abstract

<abstract abstract-type="main" id="sec1184-abs-0001"> <title>Abstract</title> <p id="sec1184-para-0001">We performed two surveys to understand how members of a university managed their passwords. At password creation, the university offered people four pre‐generated random passwords, with the option of creating their own subject to stringent requirements. All passwords expired after 120 days. We found that most respondents chose to create their own password and utilized coping strategies that undermined the security of the requirements, as well as reporting that the expiration times were too short. We also attempt to connect these behaviors to respondents' other password habits and demographics. We conclude that pre‐generated random passwords, stringent password requirements, and rapid password expiration dates are unusable security requirements for most people and lead users to subvert password requirements and reuse passwords. Copyright © 2015 John Wiley &amp; Sons, Ltd.</p> </abstract>