Authentication in the Connected World: Perceived Password Security Is Inflated

Passwords are still a popular authentication approach, even as biometric authentication has become a widespread method to access our phones. Although password managing tools can aid users in storing and securing passwords, many are unaware of their existence. In our research we adopt an interpretative research methodology in which we conduct semi-structured interviews with individuals in a UK law firm and we compare their responses to guidelines offered by NIST on passwords to assess how secure their passwords are in comparison to passwords generated using an application developed for this research project. Overall results vastly differed from the NIST guidelines, and it was established that participants are unaware of the concept of external individuals attempting to gain their passwords and are instead attempting to protect them from their peers. This research suggests that our participants should receive additional cyber security training to bridge the gap between perceived and actual security regarding password complexity and to acquire the skills required to start using modern password managers.