In an ideal world we each would have one password to remember, and that would be a strong password and we would change it every month or so. But we don't live in an ideal world, and we have to access many sites with many login prompts, and good security practice recommends that each password be different.
Can you find/site any good studies showing how many passwords (of varying complexity) an average human can effectively remember and use?
Last time I counted I had 28 different passwords required just for my direct job responsibilities (I am not including any off-time browsing for my own amusement.) What definite things can we say about the usability of this? The company recently sent around a "security guideline" that states that no password should ever be written down, nor should any password be shorter than 16 letters, they all must be unique, and we should change them every quarter. That is good in principle, but impossible in practice. The guidelines seems to have been written with the idea that each worker will have only one password.
Are there any serious usability studies that would support this as being unrealistic? If so, what is the reasonable maximum number of passwords that a worker should be required to remember?
When you overburden a user, you run several risks. At some number of passwords, users run the risk of forgetting which password to use. What is that level? Then, what is the tradeoff between writing the password down vs. using the same password at multiple sites? Does anyone know of any good studies of this?
Let me head off any discussion of password managers. I have had some good luck with one of those recently, but the company requirements specifically state that you are not allowed to use a password manager or anything else that would store the password. Clearly I want to suggest using such a manager, but I need good supporting evidence. So please don't simply say that a password manager is a good solution.