41

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the strength of the password entered?

EDIT

This question has to do with the psychological effect of the password-strength indicator. Obviously the algorithm for determining password strength must be accurate, and obviously the password strength will increase if the software forces the passwordto be a certain strength

Improve this question
8
  • Without a doubt it does. I can't point you to literature that gives evidence of it, but I can guarantee password strength indicators do increase average password strength.
    – obelia
    Commented Apr 14, 2014 at 7:09
  • @obelia: Agreed. I've definitely seen research that supports this hypothesis, yes. I'll see what I can find.
    – JonW ♦
    Commented Apr 14, 2014 at 9:32
  • 5
    It all depends on how the algorithm defines strong...
    – bhttoan
    Commented Apr 14, 2014 at 9:45
  • I'd like to look at this in light of the Heartbleed issue
    – bzav
    Commented Apr 14, 2014 at 13:58
  • If they didn't set up a feedback loop such that the form can't be submitted unless the password scores sufficiently high, then they did it wrong. A competently done meter with a feedback loop must increase password strength by definition as it forcibly excludes weak passwords.
    – aroth
    Commented Apr 15, 2014 at 5:10

5 Answers 5

Reset to default
51

Researchers from Carnegie Mellon University recently (2012) looked at password strength meters and its impact on password creation. The paper "How does your password measure up? The effect of strength meters on password creation" has all the details, but the abstract summarises their findings nicely (emphasis is mine):

We present a 2,931-subject study of password creation in the presence of 14 password meters. We found that meters with a variety of visual appearances led users to create longer passwords. However, significant increases in resistance to a password-cracking algorithm were only achieved using meters that scored passwords stringently. These stringent meters also led participants to include more digits, symbols, and uppercase letters.

Password meters also affected the act of password creation. Participants who saw stringent meters spent longer creating their password and were more likely to change their password while entering it, yet they were also more likely to find the password meter annoying. However, the most stringent meter and those without visual bars caused participants to place less importance on satisfying the meter. Participants who saw more lenient meters tried to fill the meter and were averse to choosing passwords a meter deemed "bad" or "poor."

Emphasis was added to point out the differentiation between password length, and password strength.

Improve this answer
32

Password strength indicator does not, per se, guarantee stronger passwords - from a pure UX perspective the more complex your requirements are the more likely people are to click away, to use an existing password or to write it down hence making it harder for a human to remember but, all too often, only marginally more difficult for a computer to crack.

Most password strength indicators look at two things - length and mix of "characters". The most common I see is must be at least 8 characters long and contain at least one number or special character. However, these meters do nothing to prevent use of already known passwords as well as dictionary words.

For example, if I use pa55word as my password it meets all the requirements above yet it is has an entropy of 1 and an "instant" crack time. Even changing pa55word to p@55word makes no difference as it is such a common substitution - the problem here is the use of different forms of the word password which most strength checkers do not look at.

Mark Burnett did some great research in 2011 on 10,000 top passwords based on 6m publicly available cracked username and password combinations (https://xato.net/passwords/more-top-worst-passwords) and found "this list of the 10,000 most common passwords represents 99.8% of all user passwords." Admittedly, most of them are just letters or letters and numbers but, as seen above, substituting numbers or punctuation for letters alone is not enough.

There is a good example on xkcd of the flaws of most strength checkers - basically, if you ask someone which is stronger and harder to crack (a) Tr0ub4dor&3 OR (b) correcthorsebatterystaple then most would opt for (a) yet (b) is stronger with a 550 year crack time compared to 3 days for a though a is MUCH harder to remember for most users.

enter image description here

Based on this, Dropbox came up with a new password strength indicator based on entropy (http://en.wikipedia.org/wiki/Entropy) which is worth looking at especially then comparison they did of their library against many other commonly used systems on the web for three passwords and the findings were interesting with a broad difference in the strength rating of three passwords - qwER43@!, Tr0ub4dor&3 and correcthorsebatterystaple.

https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/

Ultimately, as this is about UX you need to be careful to find a balance between security and user friendliness. Do nothing and people will use password (used 32,000 times in the above research) yet make the rules too complex and people will write them down etc

We have opted not to use any sort of password strength indicator on our application but, instead, we simply prevent anyone using any words from the top 10,000 list - it isn't perfect by any chalk but then I am not sure anything is especially when passwords like qwER43@! are considered "weak" by zxcvbn so just how can you make users choose safe passwords without having to spend days educating them which is not something you can do when trying to get customers to sign up to web application and a message saying qwER43@! is a weak password is likely to annoy all but the most strong minded customer!

Improve this answer
10
  • 3
    My [UK] keyboard has the @ and " symbols in swapped around - so it took me a few seconds to see why qwER43"! was so weak.
    – Fractional
    Commented Apr 14, 2014 at 14:09
  • Good answer. Also, thanks for the link to the dropbox blog post--that was a nice read.
    – Charles Wesley
    Commented Apr 14, 2014 at 15:36
  • Don't spend days educating them: point them to utilities like LassPass. I am sure there are more, just can think of them at the moment. Alternatively: tell them to use pass phrases such as "hair color dog black" if they have a black dog. Sure, if I know someone has a black dog that would help me guess it, but before I get around to trying all possible phrases around this fact, I'd be an octogenarian or worse. Oh and one minor pet peeve: those "strength" indicators make using pass phrases slightly cumbersome. So I tend to use them only for sites where I need to be able to do without LassPass.
    – Marjan Venema
    Commented Apr 14, 2014 at 17:33
  • 3
    +1 for the comic. Also i found this wordcloud on most common passwords: xato.net/wp-content/xup/passwordscloud.png is it an accurate description of our culture/values?
    – Pdxd
    Commented Apr 14, 2014 at 18:40
  • 1
    @pwned: That's a bold statement. Even restricting the domain to the 3,000 word vocabulary of a grade-school graduate, the number of possibilities taking 4 of them at a time produces a list of passwords and hashes that is 81,000,000,000,000 items long, or at 20 letters average length (compared to the 25 for this particular password) about 160 TB. My calculations show that a dictionary of 9 characters randomly selected from [a-zA-Z0-9!@#$%^&*()] is only 52,000 TB and so said selection of 4 random common words of length 20 occupies 0.25% of it already.
    – Pieter Geerkens
    Commented Apr 16, 2014 at 0:25
7

There's a gamification effect associated with the indicator. It tells the user they are doing something right and people generally like to achieve things.

Improve this answer
2

They increase password strength by getting the user to avoid very weak passwords, but this is barely shoring up the weak end of things. Strong passwords tend to be so far off the "high" end of password strength meters that the meters don't actually help distinguish between them.

One thing that I've seen suggested is to use "time to crack" as an indicator, instead. I think that would be a far more useful indicator (especially for your complaint of "I personally don't care"), and could be estimated very quickly on the client side.

Improve this answer
1

Password strength indicators are designed specifically to avoid setting of a very weak password, so in a way that helps the user to avoid the cycle of entering a password > submitting > coming back to change (since the system shows that the password is too weak). When the indicator shows that the password is weak the user may change/extend it to at least an acceptable level.

Most of what I have done and observed people do is that if the indicator shows moderately strong (or any thing that is above weak and acceptable) we may choose to move forward instead of getting it to a level that says very strong. Since there are some "strength" parameters used for validation in such indicators the most common one being at least 8 characters length, use of numerals, special characters, avoiding use of the usernames etc. it does make the password stronger than what the user would have used otherwise for ease of entry.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.