Instructions for Creating Passwords: How do They Help in Password Creation
Saja Althubaiti, Helen Petrie · Electronic workshops in computing · 2017
User instructions in the form of password policy or creation suggestion play an important role in helping users understand and comply with the requirements of a password creation system (PCS). Current implementations of user instructions are very varied and may cause users confusion as they move from one PCS to another which can in turn affect their password choice. Therefore, this paper investigates what kinds of instructions are provided by PCSs to support users in creating passwords and how the most frequently used instructions affect users’ password creation behaviour. An analysis of a total of 95 instructions were extracted from 27 PCSs was undertaken. Based on this analysis, an online study with 117 respondents investigated how the most frequently used instructions affect users’ password creation behaviour. The results revealed that current implementations of user instructions for password policy and creation suggestion in the PCSs do not match users’ need in creating passwords. Users prefer declarative policy before they interact with a PCS. However, they prefer procedural policy during and after their interaction with a PCS. For creation suggestions, users prefer declarative suggestions before, during and after interaction with a PCS.