Improving on the abcdef password

Question

Ok please reserve judgement on this. This is somewhere between a security and a UX question, plus it might be too broad.

I think my question can be summarised as:

What's the best way to engage a user to come up with four random words that they'd use for a password?

I'm thinking as a worst case scenario for improving the passwords for people who really aren't interested in security, but might be willing to listen to you long enough for a quick to understand suggestion.

What I imaging the scenario is that you're talking to someone and they mention that they've been having problems with finding a password for a service. At that point you might have a few seconds to grab their attention and give them some advice that would stick.

For example you're trying to get your parent / sibling / pointy haired boss to improve their password.

Or in general I'm trying to get the people who still would use 'password' or 'abcdef' to be interested enough in a password that they'd switch to a new default.

So the following would be ignored by the person:

• Password managers (at a stretch the in built browser ones)
• Diceware
• Discussions about upper / lower case / numbers / characters unless they are required for some particular website

So something similar to this comment from @Chris on this BBC password question:

It's worth remembering that the article is written in the context of people using passwords like 'password' and '123456' and 'qwerty'. For those who frequent security.stackexchange.com, sure, this method is far from great. If it reduces the number of people using '123456', though, I'm all for it.

I'm a big fan of the random four word plus spaces password concept popularised by XKCD - which is also recommended as a better solution in the accepted answer to the BBC question. What I really like about it is that it is trying to appeal to normal people, i.e. someone who would never visit security.SE or even know that such things exist.

I've tried before to tell such people about the XKCD concept and people still gloss over when I talk about that (it could just be just the way I tell it, but lets assume we're talking to someone who would laugh at my jokes).

In an ideal world I'd point them to something like http://passphra.se but again you can't get them to grip that concept easily and it doesn't work in a conversation scenario.

So the password suggestions you give would have to follow this format:

1. all lower case
2. whole words, connected to objects they can imagine

For example:

1. The last four pet names they had. You could try and get them to use the most obsure ones, i.e. fish names instead of dog names or a mix of different animals to increase the search space of names - this needs more googling along the lines of "distribution of common pet names" e.g. this book page for how insecure it would be
2. Four cousin's names. This is obviously fact checkable for someone really researching into them - especially if they're all publically linked in facebook. You could suggest alphabetical order to help them remember the order - this reduces the security but increases the memorability
3. Four local slang words, the most obvious I can think of is cockney rhyming slang, this might get people to choose words that are more random than they'd choose otherwise whilst at the same time being more fun/interesting.

I'm not saying these are perfect or would stop anyone getting into Edward Snowden's twitter account - but they should be a big improvement on 'abcdef'.

As a final point I'd imagine you might be able to append whatever extra characters you're required to use to this 'securish' base to get around stupid password rules that sites have.

Answer 1

I'd suggest that one key is to show them how they can easily choose a more secure password without making it difficult to remember.

I've done this with four simple questions - shown here with one set of answers.

• Choose some kind of critter ... Ferret
• Choose an unusual characteristic for a Ferret ... Slimy
• Choose a number ... Three
• Choose a colour ... Turquoise

Here's your password: threeSlimyTurquoiseFerrets

Everyone I've explained this approach to has agreed that they can easily use this - and if they forget one or two of the questions, they can make up their own.

Answer 2

Okay, regardless of whether you're just talking to someone about it (because they've had a whinge about passwords etc) or you're trying to present a better user interface on a website or some app, I think the best approach is to just use natural language.

In 2010 I facilitated a session around IT security in workplaces and the approach I came up with that was most adopted by attendees was the idea of using sentences to construct a password.

For example, look at these passwords:

• IlmdSbi2015
• Mai6MSW20500
• IwtCSTSit1980s

The above passwords are a lot more secure that just using something like "Password", "abc123", "Baseball", etc. And, the best thing about them, is that they are extremely easy to remember for the person who created the natural language sentence that represents the password. Let me show you what I mean:

• IlmdSbi2015 is made from I love my daughter Sarah born in 2015
• Mai6MSW20500 is made from My address is 6 Monomeeth Street Washington 20500
• IwtCSHSit1980s is made from I went to Cooper State High School in the 1980s

So, using the above technique one can create a hard to guess password that is actually very easy for the user to remember. Why? Because the password means something to them personally. And, if it requires some sort of punctuation mark, I usually just add a period (.) or exclamation mark (!) at the end or use a sentence that makes sense to have a comma in it, like an address.

This approach fits into the sloth category offered by @MichaelLai in his answer.

Basically it's easy to tell someone in conversation to just create a password using a sentence and give them an example. And, it's easy to code this process into websites or apps in a user-friendly way by using prompts or steps to walk people through it.

Hope this helps.

Answer 3

If you want to look at this from a behavioural perspective, we know that people generally need the specific type of motivation that will make them do or not do something. Generally speaking I think they fall into four categories:

1. The carrot category: give them a sweetener to do something if they are wanting a reward for the effort - probably the best user experience. This could be in the form of gamification or providing them with some sort of perceived benefit for doing so (e.g. not having to reset your password every 30 days, but perhaps not).
2. The stick category: dispense a punishment to do something if they are risk averse and do not want 'bad' things to happen - probably not the best user experience. This could be in the form of linking the action to something that they must do (e.g. timesheets) so if it is not done properly then they can't complete that action.
3. The sloth category: don't make them think about it - probably the optimal user experience in terms of effort vs. reward. Put it in so subtly that they don't notice and will probably not care, yet you've achieved what you need from them. This could be like asking some questions in a non-related area then incorporating those into the input that they provide for the password.
4. The hamster-on-the-wheel category: make them feel busy and engaged - probably the least efficient user experience in terms of effort vs. reward. Keep them occupied and doing things that makes them feel that this is an involved process and therefore of value. This could be in the form of a password security awareness workshop/game/course/training and therefore giving them a sense of accomplishment in the end.

Answer 4

People don't want to make an effort creating complex passwords because they don't have one password, they have twenty or more...

My answer would be very similar to one I gave here on how to engage users in adopting a password manager.

1. You can suggest the use of a password manager tool (and ensure your site can deal with the very long passwords they create), and try to alleviate concerns about its use and to ensure that it matches the needs of your users (e.g. mobile users will need an online password manager).
2. You can also be nice and deploy federated authentication (Google +, Facebook) and remove the need for passwords altogether.
3. Commonly done nowadays, forbid the overly common passwords. Twitter among other does that, and will tell you too many other users have this passwords and that makes you vulnerable.

Answer 5

..." which is also recommended as a better solution in the accepted answer to the BBC question." Contrary to what I (and others) assumed, some studies have found passphrases aren't any better than passwords:

1. Keith, Mark, Benjamin Shao, and Paul John Steinbart. "The usability of passphrases for authentication: An empirical field study." International journal of human-computer studies 65.1 (2007): 17-28.

"Results indicate that passphrase users experienced a rate of unsuccessful logins due to memory recall failure similar to that of users of self-generated simple passwords and stringent passwords. However, passphrase users had more failed login attempts due to typographical errors than did users of either simple or highly secure passwords. Moreover, although the typographical errors disappeared over time, passphrase users’ initial problems negatively affected their end-of-experiment perceptions."

2. Shay, Richard, et al. "Correct horse battery staple: Exploring the usability of system-assigned passphrases." Proceedings of the eighth symposium on usable privacy and security. ACM, 2012.

Caveat that these are system-generated passphrases - but then again if you're asking users to pick random words is there a difference?

"Passphrases and passwords were forgotten at similar rates, led to similar levels of user difficulty and annoyance, and were both written down by a majority of participants. However, passphrases took significantly longer for participants to enter, and appear to require error-correction to counteract entry mistakes. Passphrase usability did not seem to increase when we shrunk the dictionary from which words were chosen, reduced the number of words in a passphrase, or allowed users to change the order of words."

Sample of just two papers, granted, but I wasn't expecting it.