Those meters that rate password strength work, until they don't
Connecting state and local government leaders
A study of meters used to measure strength of passwords created on websites suggests you can only push users so far before they stop trying.
We know the limitations of passwords: They are difficult to scale, and managing truly secure passwords is a headache for administrators and end users. We also know that although there are alternate technologies for online authentication, passwords probably are here to stay.
“Passwords are not going to disappear overnight, or in the next 10 years or 20 years,” said Lujo Bauer, assistant research professor in Carnegie Mellon University’s Electrical & Computer Engineering Department.
So how to make the best of what we are stuck with? One tool increasingly common on public- and private-sector websites are strength meters, an alternative to stringent password policies intended to nudge users toward better security by providing feedback when creating passwords. As a user creates a password, it provides feedback, such as whether the password is “weak,” “good” or “strong.”
But a study of these tools at Carnegie Mellon suggests that you can only push users so far before you hit the point of diminishing returns.
Using the meters resulted in longer, sometimes better, passwords. But, “there seems to be a limit to the stringency that a user will tolerate,” researchers found. “Were meters too stringent, users might just give up.”
Percentage of passwords broken after 5 trillion guesses
| 46.7% | Created with no strength meter |
|---|---|
| 39.4% | Created with baseline strength meter |
| 39.2% | Created with meter requiring eight letters, numerals and characters for a top score |
| 33.7% | Created with a meter requiring 16 letters for a top score |
| 26.3% | Created with a meter awarding only half the score of other meters |
| 27.9% | Created with a meter awarding only one third the score of other meters |
Source: How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation
The findings are significant not because they are unexpected — they’re not — but because this apparently is the first large-scale study of a technology that is widely used but not well understood.
Bauer and colleagues at Carnegie Mellon conducted the study with 2,931 subjects who created passwords on sites using one of 14 types of meters with different displays and criteria for determining strength. The only requirement was that the password be at least eight characters long. Strength was evaluated using a simulated password-guessing algorithm and the participants returned to the test site two days later to see how well they remembered their passwords.
All of the strength meters resulted in users creating longer, more complex passwords than those created on sites with no meter. But length does not equal strength. Only users at sites using two very stringent meters produced passwords that were significantly more difficult to break.
However, security reached a plateau on the site with the most stringent meter, which gave users very low scores — grading at a rate of one-third of other meters — and required more complexity to get a strong security rating. Apparently the higher requirements frustrated users who gave up trying to please the meter.
Interestingly, the ability to remember a password two days later did not vary significantly according to its strength.
The lesson: Don’t push users too far; take the annoyance factor into account when having users create new passwords.
Bauer, who studies access control systems, had some other practical recommendations for making the most of passwords:
- Strong passwords do not have to be hard to use. Combinations of words — pass phrases — can provide a high level of security while being easy to remember.
- Length is a more effective requirement for producing strong passwords than the use of numerals and special characters. Requiring 16 letters tends to produce a stronger password than requiring a combination of eight letters, numbers and other characters.
- Instruction can have a significant impact on password strength. Explain to users why a strong password is needed and what makes it strong.