The Good and Not So Good of Enforcing Password Composition Rules

Authors:
John Campbell;Dale Kleeman;Wanli Ma
Affiliations:
School of Information Sciences and Engineering, University of Canberra, Australia;School of Information Sciences and Engineering, University of Canberra, Australia;School of Information Sciences and Engineering, University of Canberra, Australia
Venue:
Information Systems Security
Year:
2007

Citing 7
Cited 1

String searching algorithms

String searching algorithms
Security in computing

Security in computing
Defending Against the Wily Surfer-Web-based Attacks and Defenses

Proceedings of the Workshop on Intrusion Detection and Network Monitoring
The domino effect of password reuse

Communications of the ACM - Human-computer etiquette
Principles of Computer Security: Security+ and Beyond

Principles of Computer Security: Security+ and Beyond
Password Memorability and Security: Empirical Results

IEEE Security and Privacy
Password security: an empirical study

Journal of Management Information Systems

An Expert Panel Approach on Developing a Unified System Authentication Benchmarking Index

International Journal of Interdisciplinary Telecommunications and Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

Many systems rely on password composition rules to force users to choose more secure passwords. The findings discussed here are from a study on the enforcement of good password practice in the form of password composition rules. The results show that the enforcement of password composition rules does not discourage users from using meaningful information in passwords. While composition rules reduce password reuse, the overall incidence remains high. Passwords created under these conditions are also perceived to be more difficult to remember. Nevertheless, the enforcement of password composition rules does significantly improve protection against dictionary-based attack.