Introduction to Password Management and User Study Ethics

Flashcards covering the ethics of user study participation, the psychology of password management, and threat modeling concepts as discussed in the lecture.

Qualtrics

An online platform for delivering surveys and gathering consent forms used by researchers to manage participant data conveniently.

Consent form

A document that study participants must agree to, detailing their understanding of the study and permission for their data to be used.

Information sheet

A document provided to participants outlining everything they are signing up for and consenting to before beginning a study.

Password reuse

A practice where users use the same or similar passwords across multiple online accounts, creating a significant security risk if one account is compromised.

Password families

Groups of similar passwords used by a single user across different websites.

Likert scale

A rating scale used in questionnaires to measure participants' beliefs, attitudes, or justifications regarding their password habits.

Personal knowledge

Information such as a pet's name, birthday, or hometown that participants believe gives known attackers an advantage in guessing passwords.

Ability

In the context of threat modeling, a measure of who could access an account if motivation were excluded; $52\%$ of participants ranked someone they knew as most able.

Motivation

A measure of who would want to compromise an account; $62\%$ of participants selected either a competitor or a hacker as the most motivated.

Likelihood

The metric resulting from combining the ability and motivation of a potential attacker to compromise an account.

Automated attacks

Attacks involving tools that can rapidly test large lists of potential passwords, such as dates or common names, without needing personal knowledge of the user.

Strong site password

A proposed solution where a browser generates a unique password and helps the user learn it, such as by displaying it against a low-contrast background.

Social credit

The prestige or status associated with maintaining a high-level account on platforms like Wikipedia, which provides incentive for account protection.

Graphical passwords

An alternative authentication scheme that leverages the human brain's visual processing power to make credentials more memorable than text-based passwords.

Password entropy

A measure of how difficult a password is to crack through offline guessing; for example, doubling the length of a password can increase the crack time from $5$ years to more than a lifetime.

Passkeys

A modern authentication solution that aims to eliminate the password memorability problem by using cryptographic keys stored on devices.

Browser cookies

Convenient files that bypass the need for re-entering passwords on one machine but do not help in recovery if the user moves to another device or clears them.

Memory aids

Tools or methods used to help remember passwords, though the study found they did not significantly improve management compared to the burden of remembering many unique credentials.