WWW 2007 / Track: Security, Privacy, Reliability, and Ethics Session: Passwords and Phishing A Large-Scale Study of Web Password Habits Dinei Florencioˆ and Cormac Herley Microsoft Research One Microsoft Way Redmond, WA, USA
[email protected],
[email protected] ABSTRACT to gain the secret. However, challenge response systems are We report the results of a large scale study of password use generally regarded as being more time consuming than pass- and password re-use habits. The study involved half a mil- word entry and do not seem widely deployed. One time lion users over a three month period. A client component passwords have also not seen broad acceptance. The dif- on users' machines recorded a variety of password strength, ¯culty for users of remembering many passwords is obvi- usage and frequency metrics. This allows us to measure ous. Various Password Management systems o®er to assist or estimate such quantities as the average number of pass- users by having a single sign-on using a master password words and average number of accounts each user has, how [7, 13]. Again, the use of these systems does not appear many passwords she types per day, how often passwords are widespread. For a majority of users, it appears that their shared among sites, and how often they are forgotten. We growing herd of password accounts is maintained using a get extremely detailed data on password strength, the types small collection of passwords. For a user with, e.g. 30 pass- and lengths of passwords chosen, and how they vary by site.