Revisiting Password Rules: Facilitating Human Management of Passwords
Loading...
Date
2016-06
Authors
Zhang-Kennedy, Leah
Chiasson, Sonia
van Oorschot, Paul
Journal Title
Journal ISSN
Volume Title
Publisher
IEEE
Abstract
Password rules were established in the context of past security concerns. Recent work in computer security challenges the conventional wisdom of expert password advice, such as change your passwords often, do not reuse your passwords, or do not write your passwords down. The effectiveness of these rules for protecting user accounts against real world attacks is questioned. We review the latest research examining password rules for general-purpose user authentication on the web, and discuss the arguments behind the continued acceptance or the rejection of the rules based on empirical evidence and solid justifications. Following the review, we recommend an updated set of password rules.
Description
© 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works
Keywords
security, usability, cognitive science, electronic mail, biological system modelling, dictionaries, computer science