2

I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and see what happens. If you receive an error prompt ("incorrect password", or similar message) you either type the same password again (you think you must have made a typo), or try one of your other passwords (assuming people have a series of older and newer passwords that they use from day to day). In this scenario, being faced with an error message isn't uncommon -- you just move on to the next password, or re-type your password.

I have recently noticed that an on-line retailer/service provider ALWAYS returns "incorrect password" if it is the first time that you log in using a new app/browser/device, even if you typed the password correctly in the original login attempt. I suspect that they do this to thwart automated password attacks. Even if the user's password was compromised, the (automated) attacker is less likely to try it twice -- instead thinking that the user has since changed their password and that this password is no longer valid.

I have only recently started to use a password manager, and for the first time I could confirm that this service provider does this (given that the password manager is guaranteed to have entered the correct password). Simply entering the password again (asking the password manager to fill it in again), along with solving a (now additional) captcha puzzle, granted access.

So, my question: do people expect to mistype their passwords? Has anyone performed any studies in this regard? Is it (failure/mistakes) so much a part of the authentication experience that leveraging it to thwart automated password attacks "acceptable"?

I suspect the reason that the provider "gets away with it", is because the password is (eventually) stored by the local application/browser, so subsequent login attempts from the same machine/device does not trigger this behaviour. The worst-case scenario (from a user perspective) is that you were sure that you typed the password correctly the first time, then never type it in again (maybe you try a variation instead), and end up resetting your password. The account is never compromised, but people just reset their passwords often. The odd part is that they blame themselves for getting it wrong in the first place, so don't direct any negativity to the service provider.

I have not encountered anything like this from other sites/service providers before, but could replicate the results with the help of some friends that use the same service.

Just to be clear, I know that there are better ways of dealing with the authentication process. My question pertains to the expectation of the user, and people's attitude to making typos in their passwords.

EDIT: This also points to users' implicit trust of systems. If a system says the password is wrong, it must be "telling the truth", correct? Systems never "lie" about passwords. I just find it really interesting that people think this way. I never thought differently, until I noticed it being exploited by this service provider (with millions of users worldwide).

EDIT 2: I agree that it isn't "normal" to do this, but the question is not about if this is right or wrong, but instead what people expect to happen at password prompts. How often do people mistype passwords? And if it is often, do they expect it to happen? And if they expect it to happen, then it perhaps isn't such a terrible idea to leverage this loophole in user expectation to solve another problem. But first, how do users perceive their password entering ability? How do you know that?

|improve this question|||||
  • 1
    I don't usually mistype my password, but when I do, it's in complete darkness and the password input field shows every symbol as an asterisk – user1306322 Feb 4 '14 at 14:13
  • 1
    I use a password vault, so if it says I mistyped my password I know that my account has been compromised. This is at best frustrating for novices, and at worst terrifying. – VoronoiPotato Feb 4 '14 at 14:19
  • 4
    Would be nice if you share the retailer/provider in question - while may seem reasonable practice for starter it's ludicrous (punishing people for correct behaviour) and to an extent idiotic - it only stops the first attempt, which statistically would have a very low chances of involving the correct password. – Izhaki Feb 4 '14 at 15:21
  • If you think systems don't lie go watch "2001: a space odyssey" - systems get nasty – S.. Feb 4 '14 at 15:42
  • I don't want to shame any businesses. I tried to make the question more general (about expectation), but it seems people are stuck on the case study. I don't know why the company does this (I simply speculated about the security angle, since it was the only reason I could think of, but I am probably wrong). Sigh. – CJF Feb 4 '14 at 16:09
4

It's not that people expect to mistype their passwords, but rather that they know that they are not perfect typists and so they know that they occasionally will mistype their password. I type 140+ wpm, and I make typos when I can see what I type; I certainly make typos on my passwords that I can't see as well.

I've done a lot of user research on authentication. In my experience, pretty much regardless of the experience level of the user, there tends to be two paths that users go down when they get a password error message:

  1. I must have made a typo, I'll re-enter the password. This is most likely to occur on systems that they login to frequently where they're certain that they know the username/password.
  2. I'm not sure which username/password I used, I'll try another username/password. This is most likely to occur on systems that they don't login to frequently.

The second point has a couple of closely-related variants that aren't uncommon:

  • I just got back from vacation and I can't remember my password. Ask anyone who works in IT about the uptick in password reset requests that they get on Monday mornings or after common vacation times.
  • I just reset my password and have accidentally forgotten it. Anyone who works in IT can also tell you how frequently they get multiple requests in a row to change a user's password.

There's plenty of reasons associated with simple human error why people will get their username/password wrong. Note that I'm including both halves of this equation here, since users can get either of them wrong. Many systems don't specify whether the error is in the username or the password, for security reasons. For the most part, users aren't annoyed by this if it's a single error. They'll re-enter their username/password, get it right, and move on. They generally only get annoyed by it if it's particularly time-consuming.

|improve this answer|||||
  • I'm very interested in your statement "For the most part, users aren't annoyed by this if it's a single error". Did you study how drastically subsequent errors (2, 3 or 4 in a row) affects frustration? Did you keep any data on these error frequencies and frustration levels during your tests? How did you measure frustration? Did you look for "surprise" at all (example: "Oh, I thought I typed that in correctly")? If people were not surprised, then did they "expect" it? I would love to hear about your experience in this area. – CJF Feb 6 '14 at 18:59
  • Getting usernames/passwords wrong has never been a specific area of study for me. Results about it are a byproduct of doing research about authentication. I wouldn't say that "expect" is the opposite of "surprise". On first error, the response is that they accepted that they had made an error. On second error, if they use the system frequently, then they have the expectation that they aren't likely to make an error in their username/password twice in a row, and are more likely to get frustrated with the system. If they don't use the system frequently, ... – nadyne Feb 7 '14 at 1:47
  • ... then their annoyance or frustration can be turned inwards ("why can't I remember this?") or outwards ("why does this system require me to use a different username/password?"). In the not-frequently-used case, that's not an exclusive or, of course. – nadyne Feb 7 '14 at 1:49
2

I'm not sure if I understood your question. This seems to happen for a particular application that for some reason always fails the first login, even if you provided correct credentials.

Why do they do this? I don't think that this increases security in any way, so I suspect that it might be a bug. Probably they are expecting some cookie to have a value set, and when you first visit that cookie is not set.

Anyway, I don't think anyone would do that on purpose, especially since it increases the number of necessary steps to log in and might reduce conversions. You want your sign-in and log-in processes to have the minimal amount of friction, so that users can access what they want without having to struggle to get there.

|improve this answer|||||
  • I agree that it is odd behaviour. But it is consistent, from their website, mobile app, and desktop app, and has been like this for a long time (they update their apps regularly). I do believe that it thwarts automated attacks -- assuming each username/password combination is tried once. My question basically asks if people are really annoyed at themselves when re-typing their passwords, or if they expect to make a mistake ("I always forget this password" or some similar reasoning). My example points to a service that uses that reasoning to their advantage. – CJF Feb 4 '14 at 13:39
  • "Probably they are expecting some cookie to have a value set, and when you first visit that cookie is not set." This is my thought, too. – cimmanon Feb 4 '14 at 14:43
  • @CJFranken: That they update their apps regularly does not mean that they are aware of this particular bug/feature. As a software developer I know for a fact that once things such as logging in are developed, you don't spend any further thought on them (as they are working) until someone reports a problem. Anyway, why don't you ask them? If it is a bug they may be happy you reported it, if they think it helps thwart attacks they may be helped with the insight that it doesn't but may serve to drive people away. – Marjan Venema Feb 4 '14 at 17:57
2

To answer the question, "Do people expect to mistype their passwords?" The answer is NO! To expect your user to not to remember their own password is degrading. Treating your user harshly just to cover one's inability to understand good security practices is not the correct choice.

Yes, some people will forget. What is far more likely is most people will experience password fatigue and enter one of their dozens of other passwords first. Methods should exist to provide HELP to these users, not make them play games.

Locking a user after only three attempts is also a bad choice. As you mention your second attempt is usually to try to type the same password again. If you only have one more chance that is not user friendly. Having a limit of retries is a reasonable method to prevent bot attacks. But again I will say treating your user badly is not an excuse for unfriendly security practices.

|improve this answer|||||
  • One of my favorite ways to prevent brute force is to add the delay to the previous delay every time someone gets a failed login attempt. Seeing as it would take upwards of 100,000 guesses. While it might not sound like much, after 100 guesses you have to wait the age of the universe * 10^10. – VoronoiPotato Feb 4 '14 at 15:10
  • 1
    Can you point to any data/research on users' skill when entering passwords correctly for the first time? – CJF Feb 4 '14 at 15:10
  • I can't see why it's relevant. Your point was that failed log-in attempts can be used to improve security, and since that's untrue there's no need to prove any successive questions. Unless you can provide an alternate use, I don't see how such a question is relevant to others. – VoronoiPotato Feb 4 '14 at 15:13
  • Agree with @Brian. Why would someone do one thing expecting it would fail to accomplish the goal? – jff Feb 4 '14 at 19:04
1

Based on my experience with different applications, online and offline, I'd say that people don't just expect to mistype their passwords, we, are used to it, and we know it. I'll explain.

Some points have already been presented, quite clearly, like plainly forgetting the user/password, and this is, most probably, the most common scenario, based on statistics about how secure our passwords are. What's the relation, well, more and more systems are changing, requiring the user to have this or that combination on the password field, but not all of them agree on characters, minimum length, maximum length, starting character, etc, so a lot of people have slight variations of the same password, but, which one was the one used on this particular site?

Other people are not very good typing, and make mistakes more often, this group is used to make mistakes, so it will try the same combination again but paying more attention and typing more slowly than the first time.

Also, there is almost no need to really remember all the passwords, if you use different ones, since you have a reset/remind password on almost every site. So if you are trying to use a site that you haven't used in a long time, and you fail the password, almost immediately you can request it to be reset/sent to your mail. Yes it takes two or three minutes, but is a know process and it guarantees that you are going to be able to use the site/application.

Definitely, something you never expect is that a validation system blatantly lie to you, so if it says that you made a mistake, you assume that you made a mistake, or at the very least, that there was technical problem and the password received by the system was wrong somehow.

Years ago, when there was no Internet, and you had to log on your application locally or in an internal network, everybody tried to remember, somehow, their passwords, otherwise, you couldn't use the program or you will have to face a technician reminding you to at least write down the password so you don't have to call them every monday morning.

So finally, I'd say that nobody, as a first thought would say that they expect to forget the password/user, but internally, most people know that it happens and live with it.

|improve this answer|||||
0

Good design is honest.

This behavior has a number of risks for wasting a user's time, and there are better ways to thwart automated attacks. Worse yet, a power user will KNOW the password typed in was correct, so the alarm will give them a false positive indicating to them that their account has been compromised when in fact it has not. There also the risk of a novice user rotating through every password, because the correct password was said to not be correct.

|improve this answer|||||
  • I agree that there are better ways of doing it. I find the power-user's sense of KNOWING that he/she was right to be very interesting, especially when compared to a novice user (to use your example). It is this psychology that I was trying to get at: do people expect to make mistakes with passwords specifically, since the majority of password fields do not show you what you typed? Are power users (or users without password managers) exempt from making mistakes? – CJF Feb 4 '14 at 14:29
  • You may find the book "Evil by design" to be interesting, if only to show other points of view, and as a counter-point to your statement that "Good design is honest". – CJF Feb 4 '14 at 14:32
  • 1
    Many of them use password lockers so yes they are exempt. A false positive certainly indicates that the account has been compromised – VoronoiPotato Feb 4 '14 at 14:32
  • It also primes the user to be less satisfied with the experience, as every single log-in begins with a mistake. Most of my bad days in life begin with a small mistake that I never got past.Rules are made to be broken, sure but only if you've got a damn good reason to do it. – VoronoiPotato Feb 4 '14 at 14:33
  • 1
    I also disagree with the security argument. Nobody does brute force password attacks online. There are easy automatic methods of preventing it, such as prolonging the response time to subsequent login attempts from the same IP by 0.1 second. The more usual scenario is that somebody steals a database snapshot and uses a combination of potent hardware and programs which know exactly how humans make passwords non-random to reverse the password hashes found in the DB. The login form is not an obstacle for hackers, it isn't even present on the road they take. – Rumi P. Feb 4 '14 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.