Aussies’ password habits still slack, says study
Defibrillate me now
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
“Through 20 years of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess,” is how xkcd puts it*.
That’s probably why people don’t change their passwords unless someone forces them to, which is the unsurprising finding emanating from a PayPal-sponsored study by the ANU-hosted Centre for Internet Safety.
The study also finds the widespread probably-delusional belief that “my password is hard to guess”, with 90 percent of the study’s 1,000 respondents comfortable that their variation on pet’s name and child’s birthday is safe.
Perhaps surprisingly, most users reported that they don’t put any personally identifying information in their passwords; but since they believe their password is safe, they then use the same password across multiple sites (63 percent of respondents, and 77 percent between the ages of 18 to 24 years old).
Mirroring behaviours overseas, we’re also slack about protecting the password, with the survey finding that 41 percent of respondents has shared their password with a friend, family member or colleague without changing the password afterwards.
The “xkcd effect” is present in our password behaviours: hard-to-remember passwords are written down by 46 percent of respondents, while younger users prefer to store their passwords on mobile phones.
In more reassuring news, the study found that most users – more than 95 percent – don’t want Websites to remember their passwords. Well, it would be reassuring, except that more than a third of users get around the forgotten password by leaving their computers logged into online sites, rising to 76 percent among the youngsters.
The paper is published by PayPal, here.
*The comic in question is here. I can’t vouch for 'Randall’s' math, but it would be a life-changing experience for most of us if he's right.
COMMENTS
Hmm, been there.
I remember some years ago when a shiny, new passord policy came out, mandating a capital letter and a number.
I helpfully pointed out that we were a mixed environment in which many systems still only accepted 8 character passwords and that users are lazy SOBs who prefer to use just the one. Thus, what they'd effectively just mandated was a seven character dictionary word, with the first letter capitalised and a number tagged on the end. I also opined that said number would usually be zero or one.
The number of red faces around the table when I trotted that out was a joy to behold.
Corporate culture often the culprit
Some managers *insist* that the workers under their charge supply the manager with any passwords related to work; and then store them conveniently in an Excel spreadsheet. Such managers cannot understand that if the passwords of co-workers can be easily known; that there is no individual accountability amongst the workers.
If something goes wrong, then the manager has to wear the consequences.
It is beyond their comprehension that competent computing system admnistrators don't need to know the user's passwords. And it is beyond many corporate IT departments to establish mechanisms so that the need to know information can be satisfied without losing track of who did what.
There's a thick-headed "not my problem" issue with management at all levels regarding data security and the consequences of impersonation. They care not to understand. At the highest level, executives employ "security consultants" to find that there isn't a problem. That is the mission of the consultant. To find no problem. (The post-It notes stuck to the edge of the monitor disappear under the keyboard or mouse-mat during any well-publicised "audit".)
Paris; because that's the attitude.
Surely the best easy method is...
...the one where you think of an easily-memorable phrase, use the first letter from each word in the phrase and then just sub in the odd number, symbol, and capital letter.
So I might wonder "Why does posting anonymously mean I get stuck with the V icon?" Easy to remember, but hard to crack the password thus derived - "Wdpam1gswtVi?"
Not a fabulous long-term solution to the password problem, but a pretty decent compromise nonetheless, no?
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
