Am i really at risk? Determinants of online users' intentions to use strong passwords

Journal of Internet Commerce

Volumn 8, Issue 3-4, 2009, Pages 180-197

  Zhang, Lixuan ^a   McDowell, William C ^b  

^a AUGUSTA STATE UNIVERSITY   (United States)

^b EAST CAROLINA UNIVERSITY   (United States)

Author keywords

Password protection; Privacy; Protection motivation theory; Security

Indexed keywords

EID: 77951655145     PISSN: 15332861     EISSN: 1533287X     Source Type: Journal    
DOI: 10.1080/15332860903467508     Document Type: Article

References (47)

1. Adams, A., and M. S. Sasse. 1999. Users are not the enemy. Communications of the ACM 42 (12): 41-46.
2. Andrews, L. W. 2002. Passwords reveal your personality. Psychology Today. http://www.psychologytoday.com/articles/pto-20020101-000006.html (accessed February 17, 2009).
3. Beck, K. H., and A. K. Lund. 1981. The effects of health threat seriousness and personal efficacy upon intentions and behavior. Journal of Applied Social Psychology 11:401-415.
4. Bryant, K., and J. Campbell. 2006. User behaviors associated with password security and management. Australian Journal of Information Systems 14 (1): 81-100.
5. Campbell, J., D. Kleeman, and W. Ma. 2007. The good and not so good of enforcing password composition rules. Information Systems Security 16 (1): 2-8.
6. Carstens, D. S., L. Malone, and P. Bell. 2006. Applying chunking theory in organizational human factors password guidelines. Journal of Information, Information Technology, and Organization 1:97-114.
7. Carstens, D. S., R. P. McCauley-Bell, and R. F. DeMara. 2004. Evaluation of the human impact of password authentication practices on information security. Information Science Journal 7:67-85.
8. Cazier, J. A., and B. D. Medlin. 2006. Password security: An empirical investigation into e-commerce passwords and their crack times. Information Systems Security 15 (6): 45-55.
9. Cronbach, L. J. 1951. Coefficient alpha and the internal structure of tests. Psychometrika 16:297-334.
10. Dhamija, R., and A. Perrig. 2000. Déjà vu: A user study using images for authentication. Proceedings of 9th USENIX Security Symposium, August 14-17, 45-58. Denver, CO.
11. Florêncio, D., and C. Herley. 2007. A large-scale study of web password habits. Proceedings of WWW 2007, May 8-12, Banff, Alberta, Canada.
12. Floyd, D. L., S. Prentice-Dunn, and R. W. Rogers. 2000. A meta analysis of research on protection motivation theory. Journal of Applied Social Psychology 30: 407-429.
13. Gaw, S., and E. W. Felten. 2006. Password management strategies for online accounts. Proceedings of the Second Symposium on Usable Privacy and Security, July 12-14, 44-55. Pittsburgh, PA.
14. Gurung, A., X. Luo, and Q. Liao. 2009. Consumer motivation in taking action against spyware: An empirical investigation. Information Management and Computer Security 17 (3): 276-289.
15. Hair, J. F., R. L. Anderson, R. Tatham, and W. Black. 1998. Multivariate data analysis. 5th ed. New York: Prentice Hall.
16. Herath, T., and H. R. Rao. 2009. Protection motivation and deterrence: A framework for security policy compliance in organizations. European Journal of Information Systems 18:106-125.
17. Ives, B., K. R. Walsh, and H. Schneider. 2004. The domino effect of password reuse. Communications of the ACM 47 (4): 75-78.
18. Janis, I. L. 1967. Effects of fear arousal on attitude change: Recent development in theory and experimental research. In Advances in experimental social psychology (Vol. 3), ed. L. Berkowitz, 166-224. San Diego, CA: Academic Press.
19. Kaiser, H. F. 1960. The application of electronic computers to factor analysis. Education and Psychological Measurement 20:141-151.
20. LaTour, M. S., and H. J. Rotfeld. 1997. There are threats and (maybe) fear-caused arousal: Theory and confusions of appeals to fear and fear arousal itself. Journal of Advertising 26:45-59.
21. Lee, D., R. Larose, and N. Rifon. 2008. Keeping our network safe: A model of online protection behavior. Behavior and Information Technology 27:445-454.
22. Lee, Y., and K. R. Larsen. 2009. Threat or coping appraisal: Determinants of SMB executives' decision to adopt anti-malware software. European Journal of Information Systems 18: 177-187.
23. Lopes, A. B., and D. F. Galletta. 2006. Consumer perceptions and willingness to pay for intrinsically motivated online content. Journal of Management Information Systems 23 (2): 203-231.
24. Maddux, J. E., and R. W. Rogers. 1983. Protection motivation and self-efficacy: A revised theory of fear appeals and attitude change. Journal of Experimental Social Psychology 19 (5): 469-479.
25. McGuire, W. J. 1969. The nature of attitudes and attitude change. In Handbook of social psychology, Vol. 3, 2nd ed., eds. G. Lindzey, and E. Aronson, 136-314. Reading, MA: Addison-Wesley.
26. Miller, G. A. 1956. The magical number seven, plus or minus two: Some limits on our capacity for processing information. Psychological Review 63:81-97.
27. Milne, S., S. Orbell, and P. Sheeran. 2002. Combining motivational and volitional interventions to promote exercise participation: Protection motivation theory and implementation intentions. British Journal of Health Psychology 7:163-184.
28. Milne, S., P. Sheeran, and S. Orbell. 2000. Prediction and intervention in healthrelated behavior: A meta-analytic review of protection motivation theory. Journal of Applied Social Psychology 30 (1): 106-143.
29. Murgraff, V., D. White, and K. Phillips. 1999. An application of protection motivation theory to riskier single-occasion drinking. Psychology and Health 14:339-350.
30. Pechmann, C., C. Zhao, M. E. Goldberg, and E. T. Reibling. 2003. What to convey in antismoking advertisements for adolescents: The use of protection motivation theory to identify effective message theme. Journal of Marketing 67:1-18.
31. Plotnikoff, R. C., and N. Higginbotham. 2002. Protection motivation theory and exercise behavior change for the prevention of coronary heart disease in a high-risk, Australian representative community sample of adults. Psychology, Health and Medicine 7 (1): 87-98.
32. Rogers, R. W. 1975. A protection motivation theory of fear appeals and attitude change. Journal of Psychology 91:277-287.
33. Slovic, P., B. Fischhoff, and S. Lichtenstein. 1986. Facts versus fears: Understanding perceived risks. In Judgment under uncertainty: Heuristics and biases, eds. D. Kahneman, P. Slovic, and A. Tversky, 463-489. New York: Cambridge University Press.
34. Su, B. 2003. Risk behavior of Internet shopping: comparison of college students' versus non-student adults. Proceedings of the 5th International Conference on Electronic Commerce, September 30-October 3, 181-185, Pittsburgh, PA.
35. Sutton, S. R. 1982. Fear-arousing communications: a critical examination of theory and research. In Social psychology and behavioral medicine, ed. J. R. Eiser, 303-337. London: Wiley.
36. Tamil, E. M., A. H. Othman, S. A. Z. Abidin, M. Y. I. Idris, and O. Zakaria. 2007. Password practices: A study on attitude towards password usage among undergraduate students in Klang Valley, Malaysia. Journal of the Advancement of Science and Arts 3:37-42.
37. Tanner, J. F., J. B. Hunt, and D. R. Eppright. 1991. The protection motivation model: A normative model of fear appeals. Journal of Marketing 55:36-45.
38. Wang, J., and M. Wallendorf. 2006. Materialism, status signaling and product satisfaction. Journal of the Academy of Marketing Science 34 (4): 494-506.
39. Weirich, D., and M. A. Sasse. 2001. Pretty good persuasion: A first step towards effective password security in the real world. Proceedings of the 2001 Workshop on New Security Paradigms, Cloudscrofl, NM, September 10-13.
40. West, R. 2008. The psychology of security. Communications of the ACM 51 (4): 34-41.
41. Woon, I. M. Y., G. W. Tan, and R. T. Low. 2005. A protection motivation theory approach to home wireless security. Proceedings of the 26th International Conference on Information Systems, Las Vegas, NV, December 11-14, 367-380.
42. Workman, M., W. H. Bommer, and D. Straub. 2008. Security lapses and the omission of information security measures: A threat control model and empirical test. Computers in Human Behavior 24:2799-2816.
43. Wurtele, S. K., and J. E. Maddux. 1987. Relative contributions of protection motivation theory components in predicting exercise intentions and behavior. Health Psychology 6:453-466.
44. Xu, H., M. B. Rosson, and J. M. Carroll. 2007. "Increasing the Persuasiveness of IT Security Communication: Effects of Fear Appeals and Self-View," Workshop on Usable IT Security Management, Symposium on Usable Privacy and Security (SOUPS), Pittsburgh, PA.
45. Yan, J., A. Blackwell, R. Anderson, and A. Grant. 2004. Password memorability and security: Empirical results. IEEE Security and Privacy, 2:25-31.
46. Zhang, X., V. R. Prybutok, and C. E. Koh. 2006. The role of impulsiveness in a TAM-based online purchasing behavior model. Information Resource Management Journal 19 (2): 54-68.
47. Zviran, M., and W. J. Haga. 1999. Passwords security: An empirical study. Journal of Management Information Systems 15 (4): 161-185.