Two studies of the perceptions of risk, benefits and likelihood of undertaking password management behaviours. Issue 12 (10th September 2022)

• Record Type: Journal Article
• Authors: Merdenyan, Burak; Petrie, Helen
• Is Part Of: Behaviour & information technology. Volume 41:Issue 12(2022)
• Page Start: 2514
• Page End: 2527
• Publication Date: 2022-09-10
• Subjects: Passwords -- password management behaviour -- password risks -- password benefits -- usable security; Electronic data processing -- Periodicals; Human engineering -- Periodicals; Information technology -- Periodicals; 303.4833
• DOI: 10.1080/0144929X.2021.2019832
• Languages: English
• ISSNs: 0144-929X

Abstract

ABSTRACT: Passwords remain the most common form of authentication in the digital world. People have increasing numbers of passwords, and many people undertake risky password management behaviours such as re-using passwords, writing them down and sharing them. It is unclear whether people persist in these behaviours because they do not understand the risks involved or the benefits of the behaviour outweigh the risk. Two studies investigated the relationships between people's perceptions of the risks and benefits of a range of password management behaviours and their self-reports of their likelihood of undertaking them. The first study involved 120 MTurkers in the U.S.A., the second study involved 128 respondents from 26 different countries including approximately 50% students. In both studies, respondents took rated the risks, benefits and likelihood of undertaking 15 password management behaviours. The two very different samples provided very similar results, validating our classification of password management behaviours into four components: Storing, Sharing, Loggingn and Change behaviours. Somecomponents were more affected by perceptions of the benefits, others were equally affected by the perceptions of the risks and the benefits. These results have implications for how information about risky password behaviours is presented to users and general education about password security.