A secure relationship with passwords means not being attached to how you pick them
- Written by Merrill Warkentin, James J. Rouse Endowed Professor of Information Systems, Mississippi State University
When you are asked to create a password – either for a new online account or resetting login information for an existing account – you’re likely to choose a password you know you can remember[1]. Many people use extremely basic passwords[2], or a more obscure one they reuse across many sites[3]. Our research[4] has found that others – even ones who use different passwords for each site – have a method of devising them, for instance basing them all on a familiar phrase and making site-specific tweaks[5].
In all those cases, the people are creating weak passwords that are easily guessed – especially when up against automated password-cracking software that can test thousands of possibilities a second[6]. One reason for this weakness might well be their users’ emotional connection to their preexisting password creation routine.
Cybersecurity efforts often encourage people to choose stronger passwords, but rarely acknowledge the idea that people have this feeling of attachment. They focus on the measurable improvement in security without realizing they’re trying to persuade people to switch to a less personal method[7].
There’s a better way to choose a secure password.
XKCD, CC BY-SA[8][9]
Insecure tendencies
Passwords are key to cybersecurity[10] for people and companies. A single bad password can grant a hacker access to an entire network of computers and data-storage servers[11].
As a result, many computer systems force users to create new passwords regularly[12] – say, every 30 or 45 days – and require every password to contain capital letters, numbers and punctuation characters even though federal experts advise against[13] both of these practices. Regularly requiring people to choose new passwords that are hard to remember leads to unfortunate side effects. People could reuse a strong password[14] on several sites, or they could write down the new password – which is safe only if you trust the other people[15] who have access where you store the record.
Training people to create secure passwords hasn’t made much of a difference[16] to overall password security on the internet. People may not understand the risks[17] related to weak passwords – though some experts blame character flaws[18], stupidity[19] or just plain indifference[20].
The endowment effect
Our research[21] has identified another explanation for why people choose weak passwords: People feel that they own, and are emotionally attached to, the way they usually create passwords. In behavioral economics, this kind of response is called the endowment effect[22], in which people so overvalue their existing possessions[23] that they don’t want to exchange them for other items[24] – even if the new item is better or more valuable.
Seriously, it’s time to replace this old clothes washer.
Dja65/Shutterstock.com[25]
The endowment effect is usually applied to physical goods – and may help explain why your grandmother doesn’t want to get a new washing machine to replace her decades-old one. Our research suggests that the same psychological process influences how people contemplate their password creation routines.
In our study, we asked 419 participants how they created their passwords. Many used something they already knew, such as a pet name or their own birthday. Others had developed a personal system. They might have a root password and then personalize it for every different site, use a pattern on the keyboard or make up a silly sentence.
When we probed more deeply, we found that people felt a sense of ownership and personal pride about their password creation routine. One said “I think my way is a good system.” In addition, we found that they overvalued their own method and felt threatened by suggestions that it was flawed.
We provided a scenario where “Terry” derides “Pat’s” password creation routine, and then asked people how they thought Pat would react. The most popular responses were: becoming defensive, avoiding the conversation or withdrawing from it. All of these suggest that a critique of a personal password routine was perceived as an attack or a threat.
These answers we found lined up perfectly with the endowment effect, including finding that the participants labored under the illusion that their passwords provided more protection than they actually did.
More than just a habit
The attachment people feel to their password-choosing method is more than just a habit. Psychologically speaking, a habit is a behavior cued by an event[26] or an item in the environment – like brushing teeth before bed, washing hands before meals or switching off lights when leaving a room. They’re often nearly automatic, and don’t require a deliberate decision or much thought. Something that’s a habit seems to occur naturally, without any deliberate decision triggering its activation.
Choosing a password is different. It always requires deliberate and effortful cognition. That’s what brings the endowment effect into play. Cybersecurity training programs should include information not only about how to choose[27] more secure passwords, but also should acknowledge that users may feel a sense of loss about the change.
People won’t pick stronger passwords just because they’re asked to. If they feel their existing methods are being treated with disdain, they might perceive that as a personal attack, and become even less likely to adopt more secure practices.
Instead, security experts should find ways to minimize users’ sense of loss – and perhaps even encourage them to find a new emotional connection to a more secure method of choosing.
References
- ^ likely to choose a password you know you can remember (doi.org)
- ^ extremely basic passwords (www.theverge.com)
- ^ one they reuse across many sites (pixelprivacy.com)
- ^ Our research (doi.org)
- ^ a familiar phrase and making site-specific tweaks (www.troyhunt.com)
- ^ thousands of possibilities a second (arstechnica.com)
- ^ less personal method (theconversation.com)
- ^ XKCD (xkcd.com)
- ^ CC BY-SA (creativecommons.org)
- ^ Passwords are key to cybersecurity (www.veridiumid.com)
- ^ entire network of computers and data-storage servers (www.nopsec.com)
- ^ force users to create new passwords regularly (www.us-cert.gov)
- ^ federal experts advise against (nakedsecurity.sophos.com)
- ^ reuse a strong password (www.pandasecurity.com)
- ^ safe only if you trust the other people (theconversation.com)
- ^ hasn’t made much of a difference (www.cscan.org)
- ^ not understand the risks (www.pcworld.com)
- ^ character flaws (www.information-age.com)
- ^ stupidity (www.cio.com)
- ^ just plain indifference (www.ghacks.net)
- ^ Our research (doi.org)
- ^ endowment effect (dictionary.apa.org)
- ^ overvalue their existing possessions (www.businessinsider.com)
- ^ don’t want to exchange them for other items (doi.org)
- ^ Dja65/Shutterstock.com (www.shutterstock.com)
- ^ behavior cued by an event (charlesduhigg.com)
- ^ how to choose (theintercept.com)
Authors: Merrill Warkentin, James J. Rouse Endowed Professor of Information Systems, Mississippi State University
