Password Management Strategies for Online Accounts Shirley Gaw Edward W. Felten Department of Computer Science Center for Information Technology Policy Princeton University Wilson School of Public and International Affairs Princeton, NJ USA Department of Computer Science [email protected] Princeton University Princeton, NJ USA [email protected] ABSTRACT passwords to prevent dictionary attacks. As bad as pass- Given the widespread use of password authentication in on- words are, users will go out of the way to make it worse. If line correspondence, subscription services, and shopping, you ask them to choose a password, they'll choose a lousy there is growing concern about identity theft. When peo- one. If you force them to choose a good one, they'll write it ple reuse their passwords across multiple accounts, they in- on a Post-it and change it back to the password they changed crease their vulnerability; compromising one password can it from the last month. And they'll choose the same pass- help an attacker take over several accounts. Our study of word for multiple applications." [22] In short, poor password 49 undergraduates quanti¯es how many passwords they had practices undermine the system. and how often they reused these passwords. The majority Many projects focus on developing new technology around of users had three or fewer passwords and passwords were these poor practices without studying them. In contrast, reused twice. Furthermore, over time, password reuse rates this paper broadly looks at password practices, quantifying increased because people accumulated more accounts but password reuse and also surveying the contributing factors did not create more passwords. Users justi¯ed their habits. to this reuse. We not only consider how users justify their While they wanted to protect ¯nancial data and personal poor practices but also study what encourages them to do communication, reusing passwords made passwords easier better. We link these practices password management tools to manage. Users visualized threats from human attackers, and discuss ways current technology supports poor prac- particularly viewing those close to them as the most moti- tices. We also demonstrate users are ill-informed about vated and able attackers; however, participants did not sep- dictionary attacks from responses to a survey of what con- arate the human attackers from their potentially automated stitutes strong passwords and who could compromise pass- tools. They sometimes failed to realize that personalized words. passwords such as phone numbers can be cracked given a Our password study focuses on online accounts. Web- large enough dictionary and enough tries. We discuss how site authentication scales up a user's password management current systems support poor password practices. We also problem. For real world interactions, users can leverage present potential changes in website authentication systems physical context: they stand at an ATM, they hold a cell and password managers. phone, or they sit in front of their desktop. For online ac- counts, users are at the same machine but access many dif- ferent accounts. Second, real world interactions also have Categories and Subject Descriptors more regularity: people may use their voicemail password H.5.2 [User Interfaces]: Evaluation/methodology; K.6.5 or their building entry codes almost daily. Online inter- [Security and Protection]: Authentication actions may be more sporadic, where users visit a speci¯c site rarely. Altogether, these issues and the proliferation of website logins aggravate the password management prob- General Terms lem, particularly encouraging password reuse [2, 11]. password management, user behavior, password reuse Technical solutions for online password management can improve practice and without signi¯cantly changing user Keywords beavior. This is in contrast to alternatives for traditional authentication systems. These alternatives might rely on security, password, survey, user behavior the user having a particular device such as a cell phone or a physical token such as a smart card. When users access 1. INTRODUCTION website accounts, they already have their hands on a com- For password authentication systems, users often are the puter. We can develop systems at the application level or enemy. Schneier writes, \the problem is that the average at the browsers speci¯cally instead of at the device level. user can't and won't even try to remember complex enough A newly developed system should incorporate the needs of users, but few have studied users' work practices in this Copyright is held by the author/owner. Permission to make digital or hard domain. As Preece states, we must take this step to \ap- copies of all or part of this work for personal or classroom use is granted proach it by understanding the characteristics and capabil- without fee. ities of the users, what they are trying to achieve, how they Symposium On Usable Privacy and Security (SOUPS) 2006, July 12-14, achieve it currently, and whether they would achieve their 2006, Pittsburgh, PA, USA. goals more e®ectively if they were supported di®erently." to strengthen password management and also studied how [17] users justify subverting password policies. In this paper, we present a survey of how users manage There have been few papers that empirically quantify how passwords for online accounts. With this background on many passwords people have. Dhamija and Perrig used in- what users do, we can develop supportive technologies for terview data from 30 people to estimate that participants password management. In our study with 49 undergradu- had one to seven unique passwords for ten to ¯fty websites ates, we measure the extent of password reuse and examine [7]. Sasse et al. investigated several aspects of password users' justi¯cations of this practice. We ask about current use. They reported that the 144 employees surveyed had an management strategies and use data from failed login at- average of 16 passwords, but this was not limited to online tempts to understand where users have problems with pass- activities [21]. Two other studies have based estimations of word authentication. We also investigate users' models of people's passwords through surveys. Brown et al. surveyed attacks and attackers, which provide context to their se- college students and asked how many passwords they had. curity precautions. The large scope of this work helps us Students had an average of 8.18 password uses with 4.45 understand real users' practices along with the environment unique passwords (N = 218) [4]. Riley also used a survey and culture that leads to these practices. to focus on online accounts. Her results similarly indicated college and graduate students had an average of 8.5 accounts 2. RELATED WORK with an passwords (SD = 2.028, N = 328) [19]. In contrast to the above papers, our study collected password informa- As mentioned in the introduction, many projects try to tion based on login attempts to websites before asking users overcome poor password practices. For instance, several re- to estimate how many passwords they had; that is, rather searchers have suggested using graphical passwords, whether than asking people to just estimate how many passwords they use doodles [10], a series of random art images [7] they had, they were ¯rst asked to login to websites and then or people's faces [3], or points within an image [25]. The count how many passwords they used. premise with these systems is that images are easier for peo- ple to recognize or recall than text. Additionally, these sys- tems may a®ord selection of stronger passwords [12] than 3. OVERVIEW OF STUDY poor text passwords that are easily cracked [14, 15]. In con- We broadly studied password practices, focusing on real trast, Yan et al. and Bunnell et al. have focused on text users password reuse and the technology designs that en- passwords, looking at recall rates for di®erent methods to couraged (or discouraged) these practices. Our study was generate and associate these passwords [26, 6]. part laboratory exercise and part survey. Participants who Others have looked at tools for users to manage their pass- completed the two sessions of the study were compensated words, particularly password hashing systems. Yee discusses with $10 USD. Almost all participants were Princeton Uni- several password hashing systems, which can use a master versity undergraduates, with the exception of one graduate password on a second identi¯er (such as a website URL) to student and two people una±liated with the university. Sec- generate unique passwords across di®erent websites [27]. Of- tions 5 and 6.1 present results from the ¯rst session, where ten these tools try to add convenience by hiding their func- students completed an online questionnaire (58 participants: tions from the user. Both LPWA and PwdHash automat- 18 males, 40 females). Sections 4 and 6.2 present results ically substitute or ¯ll in passwords based on speci¯c user from the second session, where students came into the lab- input [9, 20], while Site Password [13] and a remote version oratory. Only 49 of the original participants completed the of PwdHash display the generated password for the user. second session (33 females, 16 males). Browser features such as Internet Explorer's AutoComplete and Firefox's Saved Passwords similarly automate ¯lling in passwords without displaying clear text to the user. These 4. QUANTIFYING PASSWORD REUSE functions then relieve the user's burden to memorize several How many online accounts do people have? BugMeNot.com passwords. claims to have accounts for at least 107,116 free websites Researchers have also conducted empirical studies of pass- that use password authentication [5]. While this collection word use and management. Petrie collected passwords from is huge, individual users have far fewer website accounts. 1,200 employees in the United Kingdom. The author con- Our survey asked participants to quantify how many web- cluded that people tended to pick passwords that represent site accounts they had and how many passwords they used themselves, a person's \password has to sum up the very across these accounts.