9

I am designing a web application for 10-13 year olds that will be used in schools. When the kids create their account, they will be asked to create a password.

I am struggling to come up with a way to guide the kids into inventing a good password. That is, I want an interactive step-by-step process that makes it more likely that they will pick something good. By 'good' I mean that it is strong against password guessing (many possible passwords) AND that it is memorable. We assume a strong password if it conforms to certain rules.

I have thought about the following, but I think they will just ignore it:

Print "Grab a book you like" 
Print "choose random chapter"
Print "Take the first four words and replace all I's with 1, all e's with 3 and all s with $ and type in what you get"
User types it in 
Print "Remember what you typed in, you will be asked for it in the future"

The replacement advice will be randomly generated and not be stored.

Maybe we could gamificate password creation? But how?

Note: The account itself isn't terribly important and the number of passwords, that an attacker can enter is limited to 3/second. However, two teachers, which we have consulted, think that such a process is a valuable learning opportunity, as textual passwords will be around for the foreseeable future.

We are stuck with text passwords because of an legacy system (Windows network) we have to be compatible with.

Improve this question
4
  • I hope I posted this in the correct forum. Information security didn't seem right because this is not about building a secure system. Its about guiding and educating children.
    – icehawk
    Commented Oct 21, 2015 at 16:50
  • I think this is the right place. Welcome to UX.SE icehawk :)
    – nightning
    Commented Oct 21, 2015 at 17:05
  • One thing to be considered - how secure is necessary? Why have something very secure? Not everything needs to be very secure. For example - why do we need special characters and numbers for a stackexchange account?
    – Mayo
    Commented Oct 21, 2015 at 17:05
  • If you really want to train them for the future, maybe you should train them to use a password locker extension. That seems to be the recommended way to keep accounts secure these days.
    – joeytwiddle
    Commented Oct 6, 2016 at 2:53

4 Answers 4

Reset to default
10

Instead of a password, how about a passphrase? Kind of like needing to know the secret phrase to enter the club house.

Passphrases tend to be less hackable by the nature of its length.

http://xkcd.com/936/

http://xkcd.com/936/

Improve this answer
7
  • 1
    I was never a big fan of this xkcd. It assumes that the attacker doesn't know users pick passphrases and therefore tries individual characters. In the real world, the attacker would grab a dictionary and just try the 100 most common words plus a few names. This leaves us with 26 bits of entropy not 44.
    – icehawk
    Commented Oct 21, 2015 at 17:47
  • Or even less if we say that the order doesn't matter, which would help memorizability...
    – icehawk
    Commented Oct 21, 2015 at 17:48
  • @icehawk Yes. No password/passphrase is 100% secure. We've now moved on to 2-factor authentication. I'm sure eventually tech will improve again that we need something else. For the purpose of introducing kids to the concept though, it'll be enough. Unless you really need to make the system secure.
    – nightning
    Commented Oct 21, 2015 at 18:08
  • 2
    It should contain a link to the comic, though. I think its required by copyright.
    – icehawk
    Commented Oct 21, 2015 at 18:24
  • I typically only use passphrases (which are a godsend) on accounts with 2-factor authentication. Even then, if the system has a good way of handling password guesses (i.e. not allowing 1000 guesses/sec forever), then it'll thwart any real attempt. But you can't rely on the server rejecting any login attempts after the 10th one for example.
    – Nick Bedford
    Commented Oct 22, 2015 at 2:32
2

I think you should show a usual password field at first.

Those users that come up with a secure enough (according to your rules) password shouldn’t be bothered with additional reading or even a password choosing wizard.

You could show a password strength checker. Users that initially decided to use a password that’s not secure enough might reconsider when they see the strength meter and change it.

After they’re finished ¹ entering the password, you could provide help for those users that entered a password which doesn’t conform to your requirements.

Warnings about password/passphrase finding strategies:

  • The example advice from your question is not secure enough. Words that appear in the same natural-language sentence (or even on the same page) are most likely not "random enough". The character replacement strategy doesn’t help much as it’s very common (and as soon as you suggest it, it should be considered public knowledge anyway).

  • If you should decide to provide advice to choose a password similar to what http://xkcd.com/936/ suggests, keep in mind that the common words must be randomly chosen! It is not secure enough to ask humans to think of 4 unrelated words, because humans are very bad at this (always making some kind of connection).

In general, suggesting specific strategies like "find a book …", "browse to your favorite website …", or "choose the 13. character on each of the first 8 pages of your diary …" should only be examples, and you should clearly communicate that your users should not follow exactly these (even if you have several of these example and show only one randomly).

I think it would be best to explain why it is important to use a secure password (threats, like what could happen to your account, others post in your name etc.), and how attackers (other users, computers that apply brute force) may try to crack it.

In case of a good explanation (and a user that actually read it …), it should be clear what not to use: a password that makes some sense (something about their own life what others could possibly know; an actual word, even if modified; a sequence of words that could possibly appear in a book, or that has some meaning to it; etc.).

This explanation alone might suffice, so allow users to make a second try. And provide a password generator at this point. For example, randomly generate their own correct horse battery staple (your application is good at this, given a large enough word list) and offer to use it as their password. (If you want increase the likeliness that they can remember it, you could show a corresponding image for each word.)

¹ Either after the password field loses focus (showing/linking the help), or after form submission (showing the wizard).

Improve this answer
1

I would lean to the xkcd.com "correct horse battery staple" example. You will bring in the concept of entropy; of calculation time and kids will have a fun time linking words together:

"chocolate booger factory"; 
"mets rule yankees drool";
"teachers leave those kids alone";

and whatever else middle school kids can think of.

Improve this answer
2
  • 1
    The comic assumes that the 4 words are randomly selected. If you let a human come up with words, it won’t be random (enough) anymore.
    – unor
    Commented Oct 22, 2015 at 20:21
  • Yes. And that's part of the conversation - the definition of randomness and how people are horrible at arriving at it.
    – Mayo
    Commented Oct 23, 2015 at 0:19
0

I can think of just one way — generate a password for them and have them note it down somewhere. Just this option as a default.

Has to sound human though, so a phrase or combination of pictures is essential...

Improve this answer
1
  • This could be risky - if it sounded human, the algorithm could be reverse engineered to see if uses, let's say, adjectives and noouns always in the same order.
    – Matt
    Commented Oct 22, 2015 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.