Do people expect to mistype their passwords?

Question

I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and see what happens. If you receive an error prompt ("incorrect password", or similar message) you either type the same password again (you think you must have made a typo), or try one of your other passwords (assuming people have a series of older and newer passwords that they use from day to day). In this scenario, being faced with an error message isn't uncommon -- you just move on to the next password, or re-type your password.

I have recently noticed that an on-line retailer/service provider ALWAYS returns "incorrect password" if it is the first time that you log in using a new app/browser/device, even if you typed the password correctly in the original login attempt. I suspect that they do this to thwart automated password attacks. Even if the user's password was compromised, the (automated) attacker is less likely to try it twice -- instead thinking that the user has since changed their password and that this password is no longer valid.

I have only recently started to use a password manager, and for the first time I could confirm that this service provider does this (given that the password manager is guaranteed to have entered the correct password). Simply entering the password again (asking the password manager to fill it in again), along with solving a (now additional) captcha puzzle, granted access.

So, my question: do people expect to mistype their passwords? Has anyone performed any studies in this regard? Is it (failure/mistakes) so much a part of the authentication experience that leveraging it to thwart automated password attacks "acceptable"?

I suspect the reason that the provider "gets away with it", is because the password is (eventually) stored by the local application/browser, so subsequent login attempts from the same machine/device does not trigger this behaviour. The worst-case scenario (from a user perspective) is that you were sure that you typed the password correctly the first time, then never type it in again (maybe you try a variation instead), and end up resetting your password. The account is never compromised, but people just reset their passwords often. The odd part is that they blame themselves for getting it wrong in the first place, so don't direct any negativity to the service provider.

I have not encountered anything like this from other sites/service providers before, but could replicate the results with the help of some friends that use the same service.

Just to be clear, I know that there are better ways of dealing with the authentication process. My question pertains to the expectation of the user, and people's attitude to making typos in their passwords.

EDIT: This also points to users' implicit trust of systems. If a system says the password is wrong, it must be "telling the truth", correct? Systems never "lie" about passwords. I just find it really interesting that people think this way. I never thought differently, until I noticed it being exploited by this service provider (with millions of users worldwide).

EDIT 2: I agree that it isn't "normal" to do this, but the question is not about if this is right or wrong, but instead what people expect to happen at password prompts. How often do people mistype passwords? And if it is often, do they expect it to happen? And if they expect it to happen, then it perhaps isn't such a terrible idea to leverage this loophole in user expectation to solve another problem. But first, how do users perceive their password entering ability? How do you know that?

Answer 1

It's not that people expect to mistype their passwords, but rather that they know that they are not perfect typists and so they know that they occasionally will mistype their password. I type 140+ wpm, and I make typos when I can see what I type; I certainly make typos on my passwords that I can't see as well.

I've done a lot of user research on authentication. In my experience, pretty much regardless of the experience level of the user, there tends to be two paths that users go down when they get a password error message:

1. I must have made a typo, I'll re-enter the password. This is most likely to occur on systems that they login to frequently where they're certain that they know the username/password.
2. I'm not sure which username/password I used, I'll try another username/password. This is most likely to occur on systems that they don't login to frequently.

The second point has a couple of closely-related variants that aren't uncommon:

• I just got back from vacation and I can't remember my password. Ask anyone who works in IT about the uptick in password reset requests that they get on Monday mornings or after common vacation times.
• I just reset my password and have accidentally forgotten it. Anyone who works in IT can also tell you how frequently they get multiple requests in a row to change a user's password.

There's plenty of reasons associated with simple human error why people will get their username/password wrong. Note that I'm including both halves of this equation here, since users can get either of them wrong. Many systems don't specify whether the error is in the username or the password, for security reasons. For the most part, users aren't annoyed by this if it's a single error. They'll re-enter their username/password, get it right, and move on. They generally only get annoyed by it if it's particularly time-consuming.

Answer 2

I'm not sure if I understood your question. This seems to happen for a particular application that for some reason always fails the first login, even if you provided correct credentials.

Why do they do this? I don't think that this increases security in any way, so I suspect that it might be a bug. Probably they are expecting some cookie to have a value set, and when you first visit that cookie is not set.

Anyway, I don't think anyone would do that on purpose, especially since it increases the number of necessary steps to log in and might reduce conversions. You want your sign-in and log-in processes to have the minimal amount of friction, so that users can access what they want without having to struggle to get there.

Answer 3

To answer the question, "Do people expect to mistype their passwords?" The answer is NO! To expect your user to not to remember their own password is degrading. Treating your user harshly just to cover one's inability to understand good security practices is not the correct choice.

Yes, some people will forget. What is far more likely is most people will experience password fatigue and enter one of their dozens of other passwords first. Methods should exist to provide HELP to these users, not make them play games.

Locking a user after only three attempts is also a bad choice. As you mention your second attempt is usually to try to type the same password again. If you only have one more chance that is not user friendly. Having a limit of retries is a reasonable method to prevent bot attacks. But again I will say treating your user badly is not an excuse for unfriendly security practices.

Answer 4

Based on my experience with different applications, online and offline, I'd say that people don't just expect to mistype their passwords, we, are used to it, and we know it. I'll explain.

Some points have already been presented, quite clearly, like plainly forgetting the user/password, and this is, most probably, the most common scenario, based on statistics about how secure our passwords are. What's the relation, well, more and more systems are changing, requiring the user to have this or that combination on the password field, but not all of them agree on characters, minimum length, maximum length, starting character, etc, so a lot of people have slight variations of the same password, but, which one was the one used on this particular site?

Other people are not very good typing, and make mistakes more often, this group is used to make mistakes, so it will try the same combination again but paying more attention and typing more slowly than the first time.

Also, there is almost no need to really remember all the passwords, if you use different ones, since you have a reset/remind password on almost every site. So if you are trying to use a site that you haven't used in a long time, and you fail the password, almost immediately you can request it to be reset/sent to your mail. Yes it takes two or three minutes, but is a know process and it guarantees that you are going to be able to use the site/application.

Definitely, something you never expect is that a validation system blatantly lie to you, so if it says that you made a mistake, you assume that you made a mistake, or at the very least, that there was technical problem and the password received by the system was wrong somehow.

Years ago, when there was no Internet, and you had to log on your application locally or in an internal network, everybody tried to remember, somehow, their passwords, otherwise, you couldn't use the program or you will have to face a technician reminding you to at least write down the password so you don't have to call them every monday morning.

So finally, I'd say that nobody, as a first thought would say that they expect to forget the password/user, but internally, most people know that it happens and live with it.

Answer 5

Good design is honest.

This behavior has a number of risks for wasting a user's time, and there are better ways to thwart automated attacks. Worse yet, a power user will KNOW the password typed in was correct, so the alarm will give them a false positive indicating to them that their account has been compromised when in fact it has not. There also the risk of a novice user rotating through every password, because the correct password was said to not be correct.