Rational security: Modelling everyday password use

International Journal of Human Computer Studies

Volumn 70, Issue 6, 2012, Pages 415-431

  Duggan, Geoffrey B ^a   Johnson, Hilary ^b   Grawemeyer, Beate ^b  

^a University of Bath   (United Kingdom)

^b University of Bath   (United Kingdom)

Author keywords

Password; Rationality; Security; Task modelling

Indexed keywords

ADMINISTRATIVE STAFF; COMPUTER SCIENTISTS; EXTERNAL CONSTRAINTS; PASSWORD; PASSWORD SECURITY; PRIMARY TASK; RATIONALITY; SECURITY; SECURITY OFFICERS; SECURITY POLICY; STUDENT GROUPS; TASK MODELLING; TASK MODELS; USER BEHAVIOUR; USER GROUPS;

COMPUTER SCIENCE; SECURITY OF DATA;

BEHAVIORAL RESEARCH;

EID: 84858182438     PISSN: 10715819     EISSN: 10959300     Source Type: Journal    
DOI: 10.1016/j.ijhcs.2012.02.008     Document Type: Article

References (52)

1. A. Acquisti, and J. Grossklags Privacy and rationality in individual decision making IEEE Security and Privacy 3 2005 26 33
2. R.B. Allen User models: theory, method, and practice International Journal of Man-Machine Studies 32 1990 511 543
3. J.R. Anderson Rational Analysis 1990 Erlbaum Hillsdale, NJ
4. J.R. Anderson, and L.J. Schooler Reflections of environment in memory Psychological Science 2 6 2001 396 408
5. Anderson, R.; 2001. Why information security is hard - an economic perspective. In: Proceedings of the 17th Annual Computer Security Applications Conference, ACSAC01, New Orleans, USA, pp. 10-14.
6. Baldwin, A.; Beres, Y.; Duggan, G.B.; Cassa Mont, M.; Johnson, H.; Middup, C.; Shiu, S.; 2011. Economic methods and decision making by security professionals. In: Proceedings of the Tenth Workshop on Economics and Information Security, WEIS 2011, Fairfax, USA.
7. A. Beautement, and M.A. Sasse The economics of user effort in information security Computer Fraud & Security 10 2009 8 12
8. Bonneau, J.; Preibusch, S.; 2010. The password thicket: technical and market failures in human authentication on the web. In: Proceedings of the Ninth Workshop on Economics and Information Security, WEIS 2010, London, UK.
9. G.J. Browne, and M.G. Pitts Stopping rule use during information search in design problems Organizational Behavior and Human Decision Processes 95 2004 208 224
10. Carter, S.; Mankoff, J.; 2005. When participants do the capturing: the role of media in diary studies. In: Proceedings of the ACM Conference on Human Factors in Computing Systems, pp. 899-908.
11. J.D. Cohen, S.M. McClure, and A.J. Yu Should I stay or should I go? How the human brain manages the trade-off between exploitation and exploration Philosophical Transactions of the Royal Society B: Biological Sciences 362 2007 933 942
12. M. Collinson, B. Monahan, and D. Pym A logical and computational theory of located resource Journal of Logic and Computation 19 2009 1207 1244
13. Collinson, M.; Monahan, B.; Pym, D.; 2010. Semantics for structured systems modelling and simulation. In: Proceedings of the Third International ICST Conference on Simulation Tools and Techniques, Torremolinos, Spain.
14. Cranor, L.F.; 2008. A framework for reasoning about the human in the loop. In: Proceedings of the First Conference on Usability, Psychology and Security.
15. H. Ebbinghaus Memory: A Contribution to Experimental Psychology 1964, 1885 Dover Publications Meneola, NY
16. K.A. Ericsson, and P.G. Polson An experimental analysis of a memory skill for dinner-orders Journal of Experimental Psychology: Learning, Memory and Cognition 14 1988 305 316
17. G. Fischer User modeling in human-computer interaction Journal of User Modeling and User-Adapted Interaction 11 2001 65 86
18. Florencio, D.; Herley, C.; 2007. A large scale study of web password habits. In: Proceedings of the 16th International Conference on World Wide Web, Banff, Alberta, Canada, pp. 657-666.
19. Florencio, D.; Herley, C.; 2010. Where do security policies come from? In: Proceedings of the Symposium on Usable Privacy and Security, SOUPS10, Redmond, USA.
20. Gaw, S.; Felten, E.W.; 2006. Password management strategies for online accounts. In: Proceedings of the Symposium on Usable Privacy and Security, SOUPS06, Pittsburgh, USA, pp. 44-55.
21. B. Grawemeyer, and H. Johnson Using and managing multiple passwords: a week to a view Interacting with Computers 23 2011 256 267
22. Herley, C.; 2009. So long and no thanks for the externalities: the rational rejection of security advice by users. In: Proceedings of the New Security Paradigms Workshop, NSPW09, Oxford, UK.
23. Hoonakker, P.; Bornoe, N.; Carayon, P.; 2009. Password authentication from a human factors perspective: results of a survey among end-users. In: Proceedings of the Human Factors and Ergonomics Society 53rd Annual Meeting, San Antonio, USA, pp. 459-463.
24. A. Howes, R.L. Lewis, and A. Vera Rational adaptation under task and processing constraints: implications for testing theories of cognition and action Psychological Review 116 4 2009 717 751
25. Inglesant, P.; Sasse, M.A.; 2010. The true cost of unusable password policies: password use in the wild. In: Proceedings of the ACM Conference on Human Factors in Computing Systems, CHI10, Atlanta, USA, pp. 382-392.
26. B. Ives, K.R. Walsh, and H. Schneider The domino effect of password reuse Communications of the ACM 47 4 2004 75 78
27. C. Jensen, C. Potts, and C. Jensen Privacy practices of Internet users: self reports versus observed behavior International Journal of Human-Computer Studies 63 2005 203 227
28. H. Johnson, and J. Hyde Towards modeling individual and collaborative construction of jigsaws using task knowledge structures (TKS) ACM Transactions on Computer-Human Interaction 10 2003 339 387
29. H. Johnson, and P. Johnson Integrating task analysis into system design surveying designers needs Ergonomics 32 1989 1451 1467
30. D. Kahneman A perspective on judgement and choice: mapping bounded rationality American Psychologist 58 2003 697 720
31. Komanduri, S.; Shay, R.; Kelley, P.G.; Mazurek, M.L.; Bauer, L.; Christin, N.; Cranor, L.F.; Egelman, S.; 2011. Of passwords and people: measuring the effect of password-composition policies. In: Proceedings of the ACM Conference on Human Factors in Computing Systems, CHI11, Vancouver, Canada, pp. 2595-2604.
32. M. Keith, B. Shao, and P.J. Steinbart The usability of passphrases for authentication: an empirical field study International Journal of Human-Computer Studies 65 2007 17 28
33. D.S. McCrickard, C.M. Chewar, J.P. Somervell, and A. Ndiwalana A model for notification systems evaluation - assessing user goals for multitasking activity ACM Transactions on Computer-Human Interaction 10 2003 312 338
34. W.R. Miller, and S. Rollnick Motivational Interviewing: Preparing People for Change 2nd ed. 2002 Guilford Press New York
35. J.F. Muth Rational expectations and the theory of price movements Econometrica 29 1961 315 335
36. E.J. ONeill, P. Johnson, and H. Johnson Representations and user-developer interaction in cooperative analysis and design Human-Computer Interaction 14 1, 2 1999 43 91
37. R. Pawson, and N. Tilley Realistic Evaluation 1997 Sage London
38. Parkin, S.; van Moorsel, A.; Inglesant, P.; Sasse, M.A.; 2010. A stealth approach to usable security: helping IT security managers to identify workable security solutions. In: Proceedings of the New Security Paradigms Workshop, NSPW10, Concord, USA.
39. S.J. Payne, G.B. Duggan, and H. Neth Discretionary task interleaving: heuristics for time allocation in cognitive foraging Journal of Experimental Psychology: General 136 2007 370 388
40. Rieman, J.; 1993. The diary study: a work-place-oriented research tool to guide laboratory efforts. In: Proceedings of the ACM Conference on Human Factors in Computing Systems, pp. 321-326.
41. P.M. Salkovskis Empirically grounded clinical interventions: cognitive-behavioural therapy progresses through a multi-dimensional approach to clinical science Behavioural and Cognitive Psychotherapy 30 2002 3 9
42. M.A. Sasse, S. Brostoff, and D. Weirich Transforming the weakest link: a human-computer interaction approach to usable and effective security BT Technical Journal 19 3 2001 122 131
43. B. Schneier Secrets and Lies: Digital Security in a Networked World 2000 Wiley and Sons New York
44. Shay, R.; Komanduri, S.; Kelley, P.G.; Leon, P.G.; Mazurek, M.L.; Bauer, L.; Christin, N.; Cranor, L.F.; 2010. Encountering stronger password requirements: user attitudes and behaviors. In: Proceedings of the Symposium on Usable Privacy and Security, SOUPS10, Redmond, USA.
45. H.A. Simon Models of Man 1957 Wiley New York
46. Spiekermann, S.; Grossklags, J.; Berendt, B.; 2001. E-privacy in 2nd generation e-commerce: privacy preferences versus actual behavior. In: Proceedings of the ACM Conference of Electronic Commerce, EC01, pp. 38-47.
47. K.L. Vu, R.W. Proctor, A. Bhargav-Spantzel, B. Tai, J. Cook, and E.E. Schultz Improving password security and memorability to protect personal and organizational information International Journal of Human-Computer Studies 65 2007 744 757
48. S. Wiedenbeck, J. Waters, J. Birget, A. Brodskiy, and N. Memon PassPoints: design and longtitudinal evaluation of a graphical password system International Journal of Human-Computer Studies 63 2005 102 127
49. Wild, P.J.; Johnson, P.; Johnson, H.; 2004. Towards a composite modelling approach for multitasking. In: Proceedings of the Third International Workshop on Task Models and Diagrams for User Interface Design, TAMODIA04, Prague, Czech Republic, pp. 17-24.
50. M.S. Wogalter Communication-human information processing (C-HIP) model M.S. Wogalter, Handbook of Warnings 2006 Lawrence Erlbaum Associates Mahwah, New Jersey
51. J. Yan, A. Blackwell, R. Anderson, and A. Grant Password memorability and security: empirical results IEEE Security and Privacy 2 2004 25 31
52. M. Zviran, and W.J. Haga Password security: an empirical study Journal of Management Information Systems 15 1999 161 185