Password Strength Meters and Password Creation Study

Vocabulary flashcards covering key terms, experimental conditions, scoring algorithms, and behavioral concepts from the Carnegie Mellon University password strength meter study.

Password Policy

A security system mechanism that mandates strict rules users must follow when creating a password, such as requiring at least $8$ characters, uppercase letters, digits, and symbols.

Password Strength Meter

A soft security feedback mechanism that provides users with dynamic visual or textual indicators (such as color bars or terms like weak, good, or strong) regarding password strength without forcing specific rules.

Nudging

The concept of guiding or helping people make better decisions through subtle interface feedback without taking away their freedom of choice.

Qualtrics

An online survey software platform utilized in the class for completing ethics checklists, submitting study materials, and collecting participant consent electronically.

Baseline Meter

An experimental meter condition that updated its visual feedback after every keystroke, scoring passwords on a scale from $0$ (empty password) to $100$ (filled meter with the word excellent).

Basic 16

A baseline priority scoring algorithm component that evaluated passwords based on achieving a minimum length of $16$ characters without requiring specific character types.

Comprehensive 8

A baseline priority scoring algorithm component that targeted passwords of at least $8$ characters containing uppercase and lowercase letters, a digit, a symbol, and passed a dictionary check.

Half Score Condition

A stringent scoring condition that displayed only half of the baseline meter score, increasing the average created password length to $14.9$ characters.

One Third Score Condition

A stringent scoring condition that displayed only one-third of the baseline meter score, increasing the average created password length to $14.3$ characters.

ZXCVBN

An algorithmic tool used to evaluate password strength and crackability by calculating the expected number of guesses required under simulated brute-force and pattern attacks.