An examination of the effort hypothesis for the perceived strength of passwords

Abstract

Previous work has examined whether keyboards that have multiple levels of entry (e.g., soft keyboards, found on mobile devices) increase users’ perceptions of password security. That work found that passwords that required greater numbers of keyboard transitions had higher perceived strength. Unfortunately, it was impossible to determine whether this increase in perceived strength was due solely to the extra keyboard transition steps or whether the inclusion of special characters in the passwords (which is required in order to increase the number of keyboard transitions) was driving that perception. The research described in this paper aims to disambiguate these two possibilities. In these experiments, rather than typing the passwords on keyboards, the users simply spoke the password. In this case, there is no additional effort or keypress required in order to enter the special character(s). Results showed that there was a positive correlation between the perceived password strength and the number of keyboard transition for spoken passwords, in a fashion nearly identical to the typed password study. This suggests that the increase in perceived password strength cannot be explained simply as a function of the additional expended effort required to enter additional keyboard transition steps, although it may play a role.