Persuasive password security

ABSTRACT

Users of password-protected systems have to be persuaded to follow certain regulations to keep systems secure. This paper describes the results of a first study of the mental models, metaphors, attitudes and skills users hold with respect to password mechanisms. It shows that users are currently not motivated to adopt proper password practices. They do not believe that they ultimately can stop somebody from getting into the system, or that somebody getting in could cause them any serious personal harm. We recommend a novel approach to the design of training and online support, which is based on an appropriate use of fear appeals.

REFERENCES

• 1: Schneier, B. Secrets and Lies. John Wiley & Sons (2000)..
• 2: Anne Adams , Martina Angela Sasse, Users are not the enemy, Communications of the ACM, v.42 n.12, p.40-46, Dec. 1999 [doi>10.1145/322796.322806]
• 3: Whitten, A. and Tygar, J. D. Why Johnny can't encrypt: A usability evaluation of PGP 5.0. 8th USENIX security composium (Washington, August 1999).
• 4: Potter, J. and Wetherell, M. Discourse and social psychology. Sage Publications Ltd (London, 1987).
• 5: Rimmer, J., Wakeman, I., Sheeran, L.,Sasse, M. A. Examining users' repertoire of Internet applications. In Sasse, M. A. and Johnson, C. (Eds.): Human-Computer Interaction - INTERACT '99(1999).
• 6: Rogers, R. W. Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation. In Cacioppo, J. and Petty, R. (Eds.): Social Psychophysiology. Guilford Press (NY, 1983).

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems
          Subjects: Human factors

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Information flow controls

  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Algorithms, Human Factors, Security

Keywords:
discourse analysis, passwords, security