User Password Generation Practices and Strong Password Guideline Compliance

Abstract

This study investigated the common password generation practices of online users. Three hundred and fifteen undergraduate and graduate college-age students completed a survey querying; internet usage demographics; the types and number of different password protected accounts maintained; actual practices used in generating, storing and using passwords; what practices users believe that they should use in generating and storing passwords; and general demographic information. Results indicate that, in general, users do not vary the complexity of passwords depending on the nature of the site or change their passwords on a regular basis if not required by the site. In generating passwords users typically report using (1) lower case letters, (2) numbers or digits, (3) personally meaningful numbers and (4) personally meaningful words.