Age and Gender Impact on Password Hygiene
Source abstract
Abstract
Password hygiene plays an essential part in securing systems protected with single-factor authentication. A significant fraction of security incidents happen due to weak or reused passwords. The reasons behind differences in security vulnerable behaviour between various user groups remains an active research topic. The paper aims to identify the impact of age and gender on password strength using a large password dataset. We recovered previously hashed passwords of 102,120 users from a leaked customer database of a car-sharing company. Although the measured effect size was small, males significantly had stronger passwords than females for all age groups. Males aged 26–45 were also significantly different from all other groups, and password complexity decreased with age for both genders equally. Overall, very weak password hygiene was observed, 72% of users based their password on a word or used a simple sequence of digits, and passwords of over 39% of users were found in word lists of previous leaks.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: User Authentication and Security Systems · Privacy, Security, and Data Protection · Innovative Human-Technology Interaction
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
General Jonas Žemaitis Military Academy of Lithuania, Šilo g. 5A, LT-10322 Vilnius, Lithuania
Cybersecurity Laboratory, Institute of Computer Science, Vilnius University, Didlaukio 47, LT-08303 Vilnius, Lithuania
Institute for Information Security and Communication Technology, Norwegian University of Science and Technology, NO-2802 Gjovik, Norway
Department of Welfare, Management, and Organization, Østfold University College, NO-1757 Halden, Norway
References (38)
Show source-provided references
1. Ponemon Institute LLC (2021, December 01). 2020 Global Encryption Trends Study. Available online: https://www.encryptionconsulting.com/wp-content/uploads/2020/04/2020-Global-Encryption-Trends-Study.pdf.
2. IBM Corporation (2021, December 01). Cost of a Data Breach Report 2020. Available online: https://www.capita.com/sites/g/files/nginej291/files/2020-08/Ponemon-Global-Cost-of-Data-Breach-Study-2020.pdf.
3. PurpleSec LLC (2021, December 01). 2021 Cyber Security Statistics The Ultimate List Of Stats, Data & Trends. Available online: https://purplesec.us/resources/cyber-security-statistics/.
4. Statista (2021, December 01). Common Password Habits of Online Adults in Selected Countries as of 2019. Available online: https://www.statista.com/statistics/1147830/common-password-habits-adults-country/.
5. Statista (2021, December 01). Which of These Personal Activities You Do on Your Employer-Issued Laptop and/or Smartphone?. Available online: https://www.statista.com/statistics/1147849/share-adults-worldwide-employer-issued-device-personal-activities/.
6. Statista (2021, December 01). Which of These Activities Do You Allow Friends or Family to Do on Your Employer-Issued Laptop and/or Smartphone?. Available online: https://www.statista.com/statistics/1148992/share-adults-worldwide-friends-family-use-employer-issued-device-personal-activities/.
7. Statista (2021, December 01). Share of Adults in Selected Countries Allowing Friends or Family to Use Their Employer-Issued Device for Personal Activities in 2020. Available online: https://www.statista.com/statistics/1147938/share-adults-worldwide-friends-family-use-employer-issued-device-personal-activities-country/.
8. Statista (2021, December 01). Share of People Who Have Restricted Applications on Their Smartphone from Accessing Personal Data in Finland in 2018, by Gender. Available online: https://www.statista.com/statistics/955247/people-restricting-smartphone-apps-data-access-gender-finland/.
9. McGill, T., and Thompson, N. (2018). Gender Differences in Information Security Perceptions and Behaviour. Australasian Conference on Information Systems, University of Technology Sydney ePress.10.5130/acis2018.co ↗
10. Gender difference and employees’ cybersecurity behaviors10.1016/j.chb.2016.12.040 ↗
11. Taking Risks With Cybersecurity: Using Knowledge and Personal Characteristics to Predict Self-Reported Cybersecurity Behaviors10.3389/fpsyg.2020.546546 ↗
12. Securing the human: Employee security vulnerability risk in organizational settings10.1002/asi.23851 ↗
13. Redmiles, E.M., Chachra, N., and Waismeyer, B. (2018, January 21–26). Examining the Demand for Spam: Who Clicks?. Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems, Montreal, QC, Canada.10.1145/3173574.3173786 ↗
14. Statista (2021, December 01). Password Management by Teenagers in France in 2019. Available online: https://www.statista.com/statistics/1225114/password-management-by-teens-france/.
15. Effectiveness of protection motivation theory based: Password hygiene training programme for youth media literacy education10.23860/JMLE-2021-13-1-6 ↗
16. Merdenyan, B., and Petrie, H. (2018, January 4–6). Generational Differences in Password Management Behaviour. Proceedings of the 32nd International BCS Human Computer Interaction Conference (HCI), Belfast, UK.10.14236/ewic/HCI2018.60 ↗
17. How do Older Adults feel about engaging with Cyber-Security?10.1002/hbe2.291 ↗
18. Recognising and addressing ‘security fatigue’10.1016/S1361-3723(09)70139-3 ↗
19. Habib, H., Naeini, P.E., Devlin, S., Oates, M., Swoopes, C., Bauer, L., Christin, N., and Cranor, L.F. (2018, January 12–14). User Behaviors and Attitudes Under Password Expiration Policies. Proceedings of the Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018), Berkeley, CA, USA. Available online: https://www.usenix.org/conference/soups2018/presentation/habib-password.
20. Understanding user passwords through password prefix and postfix (P3) graph analysis and visualization10.1007/s10207-019-00432-3 ↗
21. Adaptation of password strength estimators to a non-English environment—the Czech experience10.1016/j.cose.2020.101757 ↗
22. Wheeler, D.L. (2016, January 10–12). zxcvbn: Low-budget password strength estimation. Proceedings of the 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, USA.
23. European Commission (2021, December 01). Special Eurobarometer 499: Europeans’ Attitudes towards Cyber Security (Cybercrime) (v1.00). (2020). [Data Set], Available online: http://data.europa.eu/88u/dataset/S2249_92_2_499_ENG.
24. Holroyd, M. (2021). Thousands of CityBee users have their personal data leaked online. Euronews, Available online: https://www.euronews.com/2021/02/17/thousands-of-citybee-users-have-their-personal-data-leaked-online.
25. Lithuanian Data Protection Authority (VDAI) (2021, December 01). Car Rental Company Fined for Data Breach under the General Data Protection Regulation, Available online: https://etid.link/ETid-927.
26. Council of European Union (2016). Regulation
27. (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Off. J. Eur. Union, 59, 1-88.
28. Eastlake, D., and Jones, P. (2001). RFC 3174: US Secure Hash Algorithm 1 (SHA1), The Internet Society. RFC 3174.10.17487/rfc3174 ↗
29. Maoneke, P.B., Flowerday, S., and Isabirye, N. (2018). The influence of native language on password composition and security: A socioculture theoretical view. IFIP International Conference on ICT Systems Security and Privacy Protection, Springer.10.1007/978-3-319-99828-2_3 ↗
30. Golla, M., and Dürmuth, M. (2018). On the accuracy of password strength meters. CCS’18, Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Association for Computing Machinery.10.1145/3243734.3243769 ↗
31. Case-sensitive letter and bigram frequency counts from large-scale English corpora10.3758/BF03195586 ↗
32. Letter Frequency Analysis of Lithuanian and Other Languages Using the Latin Alphabet10.3846/cpe.2015.271 ↗
33. Normality tests for statistical analysis: A guide for non-statisticians10.5812/ijem.3505 ↗
34. Beyond power calculations: Assessing type S (sign) and type M (magnitude) errors10.1177/1745691614551642 ↗
35. Petrie, H., and Merdenyan, B. (2016). Cultural and Gender Differences in Password Behaviors: Evidence from China, Turkey and the UK. NordiCHI’16, Proceedings of the 9th Nordic Conference on Human-Computer Interaction, Association for Computing Machinery. NordiCHI’16.10.1145/2971485.2971563 ↗
36. Li, Y., Wang, H., and Sun, K. (2016, January 10–14). A study of personal information in human-chosen passwords and its security implications. Proceedings of the IEEE INFOCOM 2016—The 35th Annual IEEE International Conference on Computer Communications, San Francisco, CA, USA.10.1109/INFOCOM.2016.7524583 ↗
37. Evaluating Password Behavior at a Small University10.3844/jcssp.2019.1.9 ↗
38. Renaud, K., Zimmerman, V., Maguire, J., and Draper, S. (2017). Lessons Learned from Evaluating Eight Password Nudges in the Wild. The LASER Workshop: Learning from Authoritative Security Experiment Results (LASER 2017), USENIX Association.