Adams and Sasse: Password Usability Lecture

Group Presentations and Class Administration

• Presentation Structure: There is no strictly required structure for paper presentations, though a suggested format is the ABCA structure. Presentations should ideally consist of a $15$-minute summary of the paper’s main contributions, followed by a period for personal commentary, takeaways, and group discussion.

• Commentary and Opinions: Presenters are encouraged to add their own commentary and opinions, but these should generally be saved for the conclusion of the summary to ensure a faithful representation of the source material first.

• Group Size and Distribution: Group sizes vary between $2$ and $3$ members due to administrative adjustments regarding room sizes.

  • In a group of $2$, members speak for an average of $7.5$ minutes.

  • In a group of $3$, members speak for an average of $5$ minutes.

  • Coordination is typically easier in groups of $2$, and the difference in speaking time is considered negligible.

• Communication Tools: Group members can coordinate via the "Group Home Page" on Canvas. Posting an "Announcement" on this page typically sends an email to all group members. There is also a dedicated "Discussion Board" available for group use.

Foundations of User-Centered Security: Adams and Sasse ($1999$)

• Historical Context: The paper "Users Are Not the Enemy" was published in $1999$ in the Communications of the ACM, a magazine aimed at general practitioners and industry professionals rather than a strictly academic conference audience.

• Core Thesis: At the time of publication, security research focused almost exclusively on technical aspects such as strong cryptography while neglecting usability. The authors argue that because security mechanisms are designed, implemented, applied, and breached by people, human factors analysis is essential.

• The Security-Memorability Tension: A central theme is the tension between security (referred to as "crackability") and memorability. Systems often generate secure passwords that are impossible for humans to remember, leading users to engage in insecure workarounds.

• Standardized Guidelines (FIPS): The paper references the Federal Information Processing Standards regarding password composition, which suggested:

  • Utilizing a large character set to increase randomness and guessing difficulty.

  • Enforcing short password lifetimes requiring frequent changes.

  • Individual ownership (discouraging the sharing of accounts).

Methodological Framework and Study Design

• Data Collection: The researchers employed a mixed-methods approach:

  • Web-based Questionnaire: Gathered qualitative and quantitative data from $139$ participants. Approximately $50\%$ were from an unnamed tech company ("Company A"), and the remainder were from various other organizations.

  • Semi-structured Interviews: Conducted with $30$ participants ($15$ from the tech company and $15$ from an unnamed construction company, "Company B").

  • Focus Areas: Construction techniques, frequency of use, password recall, and organizational work practices.

• Analysis Method: The researchers used Grounded Theory, a methodology for looking at qualitative data (such as interview transcripts and open-ended survey responses) and extracting categorical meanings and explanatory models.

Primary Findings: The Four Factors of Password Behavior

• The study identified four primary factors that influence how users interact with passwords:

  1. Multiple Passwords: The requirement for users to maintain many different credentials.

  2. Content Requirements: Strict enforcement of specific characters, lengths, and complexity.

  3. Practice Compatibility: Whether security requirements conflict with actual job duties and daily workflows.

  4. User Perceived Understanding: The user's internal model of security and why it matters.

The Tension Between Security and Memorability

• Memory Strain: Maintaining multiple passwords and changing them frequently places a high cognitive load on users.

• Memory Offloading: To cope with this strain, users frequently write passwords down, which is a rational response to cognitive overload but is viewed by security professionals as a breach of protocol.

• Bypassing Constraints: When faced with strict complexity requirements, users often choose the simplest possible compliant password (e.g., using the word "password" if it meets the character count) to ensure it remains memorable.

• The Cost of Forgetting: There is a significant organizational cost associated with users forgetting passwords, including downtime, lost productivity, and the administrative burden of password resets.

Mental Models and Rational Security Behavior

• Inaccurate Mental Models: Users often apply real-world security models to digital contexts where they do not apply. For example, one participant used his wife's maiden name as a password, believing it was secure because a stranger wouldn't know it. This fails to account for automated brute-force attacks that can test millions of guesses.

• Information Sensitivity: Users often distinguish between "personally confidential" information (which they protect) and "commercially sensitive" information (like customer databases), which they may perceive as less critical to secure personally.

• Proportionate Effort: Users intuitively perform a cost-benefit analysis. They apply more effort to security for a bank account than for a low-stakes service like a Yahoo account. Research suggests this is a rational perspective, as security effort should be proportionate to the risk involved.

The "Need to Know" Principle and the Vicious Circle of Communication

• Need to Know Principle: Originating from the military, this principle suggests that the less someone knows about a security mechanism, the harder it is to attack. When applied to users, it treats them like potential enemies, withholding the reasoning behind security controls.

• The Vicious Circle of Lack of Communication:

  • The deployment of the "Need to Know" principle leads to lower user motivation because users lack awareness of why mechanisms exist.

  • Security departments fail to understand user workflows, leading to unusable mechanisms.

  • Unusable mechanisms frustrate users, reinforcing the department's belief that users are "lazy" or "careless."

  • In response, the department imposes more mechanisms, requiring more effort and further demoralizing the users, which restarts the cycle.

• Breaking the Cycle: The study recommends dropping the "Need to Know" principle and treating users as partners. Informing users about consequences and threats helps them build an accurate mental model, which is a necessary precursor for secure action.

Design Principles and Recommendations

• Security Centric Design Flaws: Rules and restrictions are often counterproductive; in some cases, relaxing strict policies can actually increase security by reducing the need for workarounds like writing passwords down.

• Primary Task Prioritization: Security is never a user's primary goal. Users will prioritize their job tasks over security, especially since security incidents are relatively rare.

• Technical Solutions Proposed in $1999$:

  • Implementation of Single Sign-On (SSO).

  • Limiting users to a maximum of $4$ to $5$ passwords.

  • Using biometrics to alleviate memorability issues.

  • Making consequences and threats visible and understandable to users.

Modern Progressions: MFA, Password Managers, and Passkeys

• MFA (Multi-Factor Authentication): While MFA (like one-time codes or push notifications) increases security, it can create a different kind of "attention overload" by requiring users to pull out a phone or device, interrupting their workflow.

• Password Managers: These solve the memorability problem by "writing down" passwords in an encrypted, secure format. This allows users to effectively only need to remember one master password (or use an OS-level biometric unlock like Face ID).

• Passkeys (FIDO2/WebAuthn): Passkeys are viewed as the potential final solution to the password problem. They combine biometric unlocks with cryptographic keys stored in hardware (Secure Enclave or TPM). They are:

  • Effortless for the user (unlock via face/fingerprint).

  • Phishing-resistant.

  • High-entropy (lengthy and complex automatically).

• Fragmentation Issues: Currently, the "ecosystem" for passkeys is fragmented. Keychains from different vendors (Apple, Windows, Google) do not always communicate seamlessly, which slows universal adoption.

Questions & Discussion

• Question: Have we solved the problem of cognitive overload with modern technologies like MFA and passkeys?

• Response: Password managers were the first major step in supporting the rational user behavior of "writing things down." Passkeys represent the second and likely final step. While MFA is secure, it can cross a threshold of annoyance (e.g., requiring a phone for every VPN login), which can lead users to avoid necessary tasks to skip the hassle.

• Question: What is the difference between qualitative and quantitative measures?

• Response: Quantitative measures are countable and numerical, such as the character length of a password or the percentage of users who clicked a button. Qualitative measures are non-countable and descriptive, such as analyzing interview transcripts to find common themes in user practices.