Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

9/28/2016
02:00 PM
Connect Directly
Facebook
Twitter
RSS
E-Mail
50%
50%

The Real Reasons Why Users Stink At Passwords

Personality, denial, and authentication-overload are big factors, new study finds.

Most users know it's risky to reuse passwords, but 61% of them do so anyway, a new study found.

The new survey released this week from security vendor LastPass takes a new tack by breaking down the psychology of user behavior, which includes some combination of willful ignorance, denial, and risk-taking with how they handle passwords.

Try as they might, the security industry continues to struggle with password protection and how to change users' behavior that puts them at risk.

The challenges of password protection are very much in the air right now. Yahoo confirmed last week that 500 million email accounts (and passwords) had been compromised. And today the White House and the National Cyber Security Alliance launched the Lock Down Your Login initiative pushing multi-factor authentication as the best way for consumers to protect themselves online. The public-private partnership includes Google, PayPal, MasterCard, Intel, Wells Fargo, Visa, Mozilla, and others.

Working with Lab42, LastPass surveyed 2,000 adults from the US, Germany, France, New Zealand, Australia, and the UK about their password habits, their beliefs and their understanding of what secure online behavior looks like. And in a nutshell, they found that while users know what safe passwords are, they tend to ignore this knowledge in favor of something that's easy to remember.

 Among other key findings from the LastPass survey:

-- 91% know it's risky to reuse passwords, but 61% do it anyway

-- The top reason users change passwords is because they've forgotten it; only 29% do so for security reasons.

--Users are most protective of their online financial accounts (69%), followed by retail (43%), social media (31%), and entertainment (20%).

A user's personality may also determine why they get hacked, LastPass says, and they rationalize dangerous or counter-intuitive behavior.

"Almost half of survey respondents identifying as Type A personalities did not believe that they are at an increased risk by reusing passwords because of their own proactive efforts, which implies their behavior stems from their need to be in control," LastPass said in a statement. "In contrast, more than half of respondents who identify as a Type B personality believe they need to limit their online accounts and activities due to fear of a password breach. By convincing themselves that their accounts are of little value to hackers, they are able to maintain their casual, laid-back attitude towards password security."

The password security problem is large and persistent. The ID Theft Resource Center reported nearly 800 data breaches in the US in 2015, exposing more than 169 million records. Compromised passwords were the port of entry for many of these attacks, according to the Verizon 2016 Data Breach Investigations Report.

And while infosec professionals and security consultants relentlessly warn against password reuse and encourage strong, unique passwords, the LastPass data suggests a fair amount of overwhelm and even resignation on the part of users.  

"People really are overwhelmed and feeling helpless," where password security is concerned, says Mark Burnett, security consultant and author of Perfect Passwords. Passwords have reached the limit of their usefulness, but business and consumers still need the secrecy aspect, he adds. Smarter authentication may strengthen security but is also difficult to manage.

While Burnett thinks multi-factor authentication works well, he points to the cost of hardware tokens and how businesses handle their loss, theft and replacement as potential drawbacks.

"What we really need is flexible authentication that uses multiple methods, like a token when you're at computer and something else for your smartphone," Burnett adds. "We need something that looks at multiple factors like time of day you're logging in or recognizes suspicious activity."

He points to FIDO-based universal two-factor authentication (U2F) as one possible fix, supported by Google, Dropbox, and others. 

Related Content:

 

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain's New York Business, Red Herring, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
jfontana
50%
50%
jfontana,
User Rank: Author
9/7/2018 | 7:25:49 PM
Two-years on and this story still relevant
This is why authentication is getting a facelift.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/30/2016 | 3:17:52 PM
Re: Passwords and user behavior
I very much agree. I'm thinking this cost pertains more to the laptop, desktop, and server environments. Mobile phones have evolved to the point where touch is the major interface point, making fingerprinting a logical premise. Laptops and other devices outside of the handheld realm haven't been as quick to make that transition. Now with the laptops being touch screen on many of the newer models I can definitely see an integration in the near future. The main question is, on devices that don't have this consistent touch interface what is the cost to create a biometric interface?
T Sweeney
50%
50%
T Sweeney,
User Rank: Moderator
9/30/2016 | 12:31:18 PM
Re: Passwords and user behavior
I hear you on the issue of cost and multi-factor authentication, RyanSepe. Still, smartphone makers have been able to incorporate fingerprint technology into their gear without any apparent increase in the cost of the phones. So it leaves me wondering, how hard (okay, expensive) can it really be?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/30/2016 | 9:24:11 AM
Re: Changing password often
I would think the potential benefit is random when changing passwords. Meaning if someone is trying to bruteforce it either via dictionary or rainbow tables if you change to a password that was previously attempted then the security principle of changes passwords benefited you. If not, then your password is just a new password that has yet to be attempted.

Can you elaborate to how changing passwords would have a negative effect? Not sure how that plays out. Thanks,
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/30/2016 | 9:21:54 AM
Re: Passwords and user behavior
Yes depending on your method of biometrics privacy concerns are relevant. IE retina scans can identify potential health issues which is private information.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/30/2016 | 9:19:47 AM
Re: Passwords and user behavior
Yes there needs to be consistency. I believe there are laptops that open via fingerprint I am just not sure as to the efficacy of that mechanism for laptops.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2016 | 6:12:29 PM
Re: Passwords and user behavior
"... fingerprint ..." For some reason fingerprints do not pickup on other devices other than mobile phones. I always use it on my iPhone but not on my laptop. It needs to be stable and easy to use across devices.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2016 | 6:09:34 PM
Re: Passwords and user behavior
"... additional parameter is cost ..." Agree. There is cost and there is privacy issues in the alternative solutions. Our DNA clearly indnetifies us uniquelly, of course we are not allowed to use it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2016 | 6:06:39 PM
Re: Passwords and user behavior
"... the human factor ..." Agree. We want things that are simple and not forcing us to remember things in our busy daily lives.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/29/2016 | 6:04:33 PM
Re: Passwords and user behavior
"... Awareness and training will help marginally, ..." Mainly agree but password being the credentialing is a main problem. Not secure by nature.
Page 1 / 2   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15505
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2020-15506
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15507
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to read files on the system via unspecified vectors.
CVE-2020-15096
PUBLISHED: 2020-07-07
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affecte...
CVE-2020-4075
PUBLISHED: 2020-07-07
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not ...