[Paper Review] Prospects for Improving Password Selection

Eryn Ma, Summer Hasama+2 more|arXiv (Cornell University)|Jan 4, 2022

User Authentication and Security Systems4 citations

TL;DR

This study applies prospect theory—specifically the reference-dependence effect—to improve password selection by framing weak passwords as a loss relative to stronger alternatives. In a user study of 762 participants, a negatively framed prompt increased password strength in 25% of users and reduced weak passwords by 25%, demonstrating that loss-framing can effectively nudge users toward stronger security choices.

ABSTRACT

User-chosen passwords remain essential to online security, and yet people continue to choose weak, insecure passwords. In this work, we investigate whether prospect theory, a behavioral model of how people evaluate risk, can provide insights into how users choose passwords and whether it can motivate new designs for password selection mechanisms that will nudge users to select stronger passwords. We ran a user study with 762 participants, and we found that an intervention guided by prospect theory -- which leverages the reference-dependence effect by framing selecting weak passwords as a loss relative to choosing a stronger password -- causes approximately 25% of users to improve the strength of their password (significantly more than alternative interventions) and reduced the final number of weak passwords by approximately 25%. We also evaluate the relation between user behavior and users' mental models of hacking and password attacks. These results provide guidance for designing and implementing account registration mechanisms that will significantly improve the strength of user-selected passwords, thereby leveraging insights from prospect theory to improve the security of systems that use password-based authentication.

Motivation & Objective

• To investigate whether prospect theory, particularly the reference-dependence effect, applies to user password selection decisions.
• To evaluate whether framing password strength improvements as losses can effectively nudge users toward selecting stronger passwords.
• To assess the impact of mental models of hacking and password attacks on user behavior during account registration.
• To determine whether prompt phrasing (specific vs. vague) influences user decisions to strengthen passwords.
• To provide actionable design insights for password registration mechanisms that enhance system-wide security through behavioral nudges.

Proposed method

• Conducted a user study with 762 participants completing a simulated account registration process.
• Presented users who selected weak or moderate passwords with an interactive follow-up prompt that varied in framing (positive, neutral, negative) and phrasing (specific, vague).
• Used a negative framing that emphasized the security loss from choosing a weak password compared to a stronger one.
• Measured password strength using a dictionary-based method that identifies common and weak password patterns.
• Collected follow-up survey data to assess users’ mental models of hacking threats and password risks.
• Applied statistical analysis (p-values) to evaluate the significance of differences in password improvement rates across framing and phrasing conditions.

Experimental results

Research questions

• RQ1 Does the reference-dependence effect from prospect theory influence users’ decisions to strengthen weak passwords during account creation?
• RQ2 Does the source-dependence effect—specifically, whether prompts are phrased specifically or vaguely—affect users’ willingness to improve password strength?
• RQ3 How do users’ mental models of hacking and password attacks correlate with their actual password selection behavior?
• RQ4 Can a prospect theory-driven intervention significantly reduce the number of weak passwords selected in a real-world-like registration scenario?
• RQ5 Is the effectiveness of loss-framing consistent across different user mental models of password risks?

Key findings

• A negatively framed prompt—presenting weak password selection as a loss relative to stronger alternatives—significantly increased the rate of password improvement (p < .001) compared to neutral or positive framing.
• Approximately 25% of users who initially selected weak or moderate passwords improved their password strength after interacting with the negative framing prompt.
• The final number of weak passwords selected after the intervention was significantly lower than the initial number (p = .019), confirming a measurable reduction in weak password usage.
• The source-dependence effect did not significantly influence user behavior, as the phrasing of the prompt (specific vs. vague) had no significant impact on password improvement (p = .611).
• Users’ mental models of who is targeted by hackers were correlated with password choices, but password strength decisions remained consistent across different mental models.
• The study demonstrates that loss-framing based on prospect theory can be a powerful, ethically deployable nudge to enhance password security in real-world systems.