Abstract:Due to increasing security awareness of password from the public and little attention on the characteristics of real-life passwords, it is thus natural to understand the current state of characteristics of real-life passwords, and to explore how password characteristics change over time and how earlier password practice is understood in current context. In this work, we attempt to present an in-depth and comprehensive understanding of user practice in real-life passwords, and to see whether the previous observations can be confirmed or reversed, based on large-scale measurements rather than anecdotal knowledge or user surveys. Specifically, we measure password characteristics on over 6 million passwords, in terms of password length, password composition, and password selection. We then make informed comparisons of the findings between our investigation and previously reported results. Our general findings include: (1) average password length is at least 12% longer than previous results, and 75% of our passwords have the length between 8 and 10 characters; (2) there is a significant increase of using only numbers as passwords, and easy-to-reach symbols are always the first choice when users added symbols into passwords; (3) there observes a remarkable increase (about 40%) of using combo-meaningful data as passwords, and a striking proportion of using the most common passwords or login names as passwords. Our investigation also includes collecting statistics about the use of symbols, letter-case, and meaningful details, which presents a systematic analysis of password usage. The comparative results indicate that the password characteristics and password practice on this massive password data set are somewhat inconsistent with those from anecdotal knowledge and user surveys, and exhibit a substantial change over time in some ways. Further research needs to build upon this understanding for gaining insight into how password security can be improved.

A Cross-cultural Perspective for Personalizing Picture Passwords

A Case Study of Graphical Passwords in a Chinese University

From Hot-Spots Towards Experience-Spots: Leveraging on Users' Sociocultural Experiences to Enhance Security in Cued-Recall Graphical Authentication.

The Factors Affect User Behaviour in a Picture-Based User Authentication System: PixelPin

User Study: Comparison of Picture Passwords and Current Login Approaches

Cash, Cards or Cryptocurrencies? A Study of Payment Culture in Four Countries

Poster: Using Chinese Characters For Authentication-Algorithmic Framework And Empirical Results

An Investigation into the use of Images as Password Cues

On the Security of Picture Gesture Authentication.

PiXi: Password Inspiration by Exploring Information

An Exploration of Graphical Password Authentication for Children

User Practice in Password Security: an Empirical Study of Real-Life Passwords in the Wild

Utilizing binary code to improve usability of pressure-based authentication

Passmap: A Map Based Graphical-Password Authentication System

Passwords and Perceptions.

That Depends -- Assessing User Perceptions of Authentication Schemes across Contexts of Use

Exploiting multimodal biometrics for enhancing password security

An Open Model for Researching the Role of Culture in Online Self-Disclosure

A Cross-Cultural Perspective on the Privacy Calculus

Picture Perfect or Picture True: A Comparative Study on Social Media Profile Picture Presentation and Motivations for Use among Chinese and American from Cultural Perspective

A Gamified Approach to Improve Users' Memorability of Fall-back Authentication