Enhancing password security through interactive fear appeals: A web-based field experiment

Proceedings of the Annual Hawaii International Conference on System Sciences

Volumn , Issue , 2013, Pages 2988-2997

  Vance, Anthony ^a   Eargle, David ^a   Ouimet, Kirk ^a   Straub, Detmar ^b  

^a BRIGHAM YOUNG UNIVERSITY   (United States)

^b GEORGIA STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AUTHENTICATION MECHANISMS; FIELD EXPERIMENT; INTERACTIVITY; PASSWORD SECURITY; PASSWORD STRENGTH; REGISTRATION PROCESS; STRONG PASSWORD; WEAK PASSWORDS;

SECURITY OF DATA; SYSTEMS SCIENCE; WEBSITES;

AUTHENTICATION;

EID: 84875495633     PISSN: 15301605     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2013.196     Document Type: Conference Paper

References (45)

1. A. Adams and M. A. Sasse, "Users are not the enemy", Communications of the ACM, 42 (1999), pp. 40-46.
2. T. Bouchard, "Field research methods: Interviewing, questionnaires, participant observation, systematic observation, unobtrusive measures", Handbook of industrial and organizational psychology (1976), pp. 363-413.
3. M.-C. Boudreau, D. Gefen and D. W. Straub, "Validation in Information Systems Research: A State-ofthe-Art Assessment", MIS Quarterly, 25 (2001), pp. 1-16.
4. M. Burnett and D. Kleiman, "Perfect Passwords: Selection, Protection, Authentication", (2006), pp. 53-59.
5. B. Calder, L. Phillips and A. M. Tybout, "Designing research for application", Journal of Consumer Research, 8 (1981), pp. 197-207.
6. M. Csikszentmihalyi, Flow: The psychology of optimal experience, Harper Perennial, 1990.
7. A. R. Dennis and J. S. Valacich, "Conducting Experimental Research in Information Systems", Communications of the Association for Information Systems, 7 (2001), pp. 1-41.
8. D. Florencio and C. Herley, A large-scale study of web password habits, Proceedings of the 16th international conference on World Wide Web - WWW '07, ACM Press, New York, New York, USA, 2007, pp. 657.
9. A. Forget, S. Chiasson, P. van Oorschot and R. Biddle, Persuasion for Stronger Passwords: Motivation and Pilot Study, in H. Oinas-Kukkonen, P. Hasle, M. Harjumaa, K. Segerståhl and P. Øhrstr øm, eds., Springer Berlin /Heidelberg, 2008, pp. 140-150.
10. S. Furnell, "Assessing password guidance and enforcement on leading websites", Computer Fraud & Security, 2011 (2011), pp. 10-18.
11. S. Furnell, "An assessment of website password practices", Computers & Security, 26 (2007), pp. 445-451.
12. J. Ghani, Flow in human-computer interactions: test of a model, in J. M. Carey, ed., Human Factors in Information Systems, Ablex Publishing Copr., Norwood, NJ, USA, 1995, pp. 291 - 311.
13. T. Herath and H. R. Rao, "Protection motivation and deterrence: a framework for security policy compliance in organisations", European Journal of Information, 18 (2009), pp. 106-125.
14. C. Herley, "So long, and no thanks for the externalities: the rational rejection of security advice by users", Proceedings of the 2009 workshop on New security (2009).
15. C. Hovland and I. Janis, "Communication and persuasion; psychological studies of opinion change.", (1953).
16. C. Hull, Principles of Behavior, Appleton-Century-Crofts, 1943.
17. Imperva, Consumer Password Worst Practices, Imperva Application Defense Center, 2010, pp. 1-5.
18. Z. Jiang and I. Benbasat, "Research Note Investigating the Influence of the Functional Mechanisms of Online Product Presentations", Information Systems Research, 18 (2007), pp. 454-470.
19. A. C. Johnston and M. Warkentin, "Fear Appeals and Information Security Behaviors: An Empirical Study", MIS Quarterly, 34 (2010), pp. 549-566.
20. A. C. Johnston and M. Warkentin, Persuasive Communication Strategies: Assessing the Fit Between Organizational Identification and Fear Appeal Message Orientation, The Dewald Roode Information Security Workshop, IFIP WG 8.11/11.13, 2010, pp. 128-154.
21. M. Keith, B. Shao and P. Steinbart, "A Behavioral Analysis of Passphrase Design and Effectiveness", Journal of the Association for Information Systems, 10 (2009).
22. P. R. Killeen, "Incentive theory", Nebraska Symposium on Motivation, 29 (1981), pp. 169-216.
23. E. Lee, Arousal Theory and the religiosity-Criminality Relationship, in L. J. Siegel and P. Cordella, eds., Contemporary Criminology Theory, Northeastern University Press, Boston, 1996, pp. 65-84.
24. D. B. Lindsley, Psychophysiology and Motivation, University of Nebraska Press, Lincoln, 1957.
25. J. E. McGrath, "Dilemmatics: The Study of Research Choices and Dilemmas", American Behavioral Scientist, 25 (1981), pp. 179-210.
26. K. A. McNeil, I. Newman and F. J. Kelly, "Testing Research Hypotheses With the General Linear Model", (1996), pp. 372.
27. R. Morris and K. Thompson, "Password security: A case history", Communications of the ACM, 22 (1979), pp. 594-597.
28. T. Novak, D. Hoffman and Y. Yung, "Measuring the Flow Construct in Online Environments: A Structural Modeling Approach", Marketing Science, 19 (2000), pp. 22 - 44.
29. R. Rogers, "{Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation}", Social psychophysiology (1983), pp. 153 - 176.
30. R. W. Rogers, "A Protection Motivation Theory of Fear Appeals and Attitude Change1", The Journal of Psychology, 91 (1975), pp. 93-114.
31. A. Rutherford, "Anova and Ancova: A Glm Approach", (2011), pp. 360.
32. J. Steuer, "Defining Virtual Reality: Dimensions Determining Telepresence", Journal of Communication, 42 (1992), pp. 73-93.
33. D. Straub, M.-C. Boudreau and D. Gefen, "Validation Guidelines for IS Positivist Research", Communications of the Association for Information Systems, 13 (2004), pp. 380-427.
34. D. Straub, P. Carlson and E. Jones, "Deterring cheating by student programmers: A field experiment in computer security", Journal of Management Systems, 5 (1993), pp. 33-48.
35. L. K. Trevino and J. Webster, "Flow in Computer-Mediated Communication: Electronic Mail and Voice Mail Evaluation and Impacts", Communication Research, 19 (1992), pp. 539-573.
36. Trusteer, Reused Login Credentials, Trusteer, New York, New York, USA, 2010.
37. A. Vance, If Your Password is 123456, Just Make It HackMe, New York Times, 2010.
38. A. Vance, M. Siponen and S. Pahnila, "Motivating IS security compliance: Insights from Habit and Protection Motivation Theory", Information & Management, 49 (2012), pp. 190-198.
39. D. Weirich and M. A. Sasse, Pretty good persuasion, Proceedings of the 2001 workshop on New security paradigms - NSPW '01, ACM Press, New York, New York, USA, 2001, pp. 137.
40. N. Wiener, Cybernetics or control and communication in the animal and the machine, MIT Press, Cambridge, MA, 1948.
41. K. Witte, "Putting the fear back into fear appeals: The extended parallel process model", Communications Monographs (1992).
42. M. Workman, W. Bommer and D. Straub, "Security lapses and the omission of information security measures: A threat control model and empirical test", Computers in Human Behavior, 24 (2008), pp. 2799-2816.
43. J. Yan, A. Blackwell, R. Anderson and A. Grant, "Password memorability and security: empirical results", IEEE Security & Privacy Magazine, 2 (2004), pp. 25-31.
44. J. Zhang, X. Luo, S. Akkaladevi and J. Ziegelmayer, "Improving multiple-password recall: an empirical study", European Journal of Information Systems, 18 (2009), pp. 165-176.
45. M. Zviran and W. J. Haga, "Password security: an empirical study", Journal of Management Information Systems, 15 (1999), pp. 161-185.