A large-scale study of web password habits

By Dinei A. F. Florêncio, Cormac Herley. 2007

1,234 citations recorded by the source corpus.

Subfields: Information Systems, Human-Computer Interaction, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Human-Computer Interaction

In Signal Processing

Citations in the corpus

Differentially Private Password Frequency Lists (2016, background): “Several empirical studies have shown that these password composition policies frustrate users and result in more forgotten passwords [24], [15] and may sometimes even cause users to select weaker passwords [23], [3].”
The Plight of the Targeted Attacker in a World of Scale (2010, background): “For example, a growing body of measurement studies make clear that users choose weak passwords and re-use them liberally [21], choose easily guessed backup authentication questions [43], are oblivious to security cues [41], ignore certiﬁcate error warnings [26] and cannot tell legitimate web-sites…”
The true cost of unusable password policies: password use in the wild (2010, background): “Since then, we have seen studies of passwords using controlled [22] and survey methodologies [10, 23], which provide some understanding of the policy factors that make passwords easier to generate, remember, and use, in ways which are appropriate to the situation.”
You've been warned: an empirical study of the effectiveness of web browser phishing warnings (2008, background): “4% of the population falls for phishing attacks annually [9].”
"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, background): “Florencio and Herley conducted a large scale study in which they monitored participants’ password habits through specially designed software running on participants’ machines [16].”
Face Recognition on Consumer Devices: Reflections on Replay Attacks (2015, background): “The ever bewildering com-plexity rules and seemingly never ending accumulation of more passwords results in users eventually forgetting one or more passwords [2], [3].”
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, background): “Because of the efficiency of our calculations (compared to guessing passwords directly), we can investigate the effectiveness of multiple password-guessing approaches with multiple tunings.”
A Study of Probabilistic Password Models (2014, background): “8 for other scenarios, because of space limitation.”
Graphical passwords: Learning from the first twelve years (2012, background): “Web-Based user studies are gaining popularity [Florencio and Herley 2007; Andrews et al. 2003; Moncur and Leplatre 2007; Everitt et al. 2009].”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, background): “Without intervention, users tend to create simple passwords [12, 23, 33, 41].”
An Empirical Analysis of Phishing Blacklists (2009, background): “4% of recipients were victimized by phishing attacks [12].”
The Tangled Web of Password Reuse (2014, background): “Unfortunately, the number of passwords a user must re-member continues to increase, with typical Internet user estimated to have 25 distinct online accounts [10], [11], [32].”
Of passwords and people: measuring the effect of password-composition policies (2011, background): “Florêncio and Herley estimated entropy for a large set of real passwords they observed, calculating the theoretical maximum for each password given the set of character types used [5].”
Password Strength: An Empirical Analysis (2010, background): “In a 2007 study [11], Florencio and Herley analyzed data”
The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes (2012, background): “This work grew out of the Related Work section of Pico [8].”