Two studies of the perceptions of risk, benefits and likelihood of undertaking password management behaviours

Passwords remain the most common form of authentication in the digital world. People have increasing numbers of passwords, and many people undertake risky password management behaviours such as re-using passwords, writing them down and sharing them. It is unclear whether people persist in these behaviours because they do not understand the risks involved or the benefits of the behaviour outweigh the risk. Two studies investigated the relationships between people's perceptions of the risks and benefits of a range of password management behaviours and their self-reports of their likelihood of undertaking them. The first study involved 120 MTurkers in the U.S.A., the second study involved 128 respondents from 26 different countries including approximately 50% students. In both studies, respondents took rated the risks, benefits and likelihood of undertaking 15 password management behaviours. The two very different samples provided very similar results, validating our classification of password management behaviours into four components: Storing, Sharing, Loggingn and Change behaviours. Somecomponents were more affected by perceptions of the benefits, others were equally affected by the perceptions of the risks and the benefits. These results have implications for how information about risky password behaviours is presented to users and general education about password security.