“I added '!' at the end to make it secure”: observing password creation in the lab
Blase Ur, Fumiko Noma, Jonathan Bees, Sean M. Segreti, Richard Shay, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor · 2015
Users often make passwords that are easy for attackers to guess. Prior studies have documented features that lead to easily guessed passwords, but have not probed why users craft weak passwords. To understand the genesis of common password patterns and un-cover average users ’ misconceptions about password strength, we conducted a qualitative interview study. In our lab, 49 participants each created passwords for fictitious banking, email, and news web-site accounts while thinking aloud. We then interviewed them about their general strategies and inspirations. Most participants had a well-defined process for creating passwords. In some cases, partic-ipants consciously made weak passwords. In other cases, however, weak passwords resulted from misconceptions, such as the belief that adding “! ” to the end of a password instantly makes it secure or that words that are difficult to spell are more secure than easy-to-spell words. Participants commonly anticipated only very targeted attacks, believing that using a birthday or name is secure if those data are not on Facebook. In contrast, some participants made se-cure passwords using unpredictable phrases or non-standard cap-italization. Based on our data, we identify aspects of password creation ripe for improved guidance or automated intervention. 1.