The Real Reasons Why Users Stink At Passwords

Personality, denial, and authentication-overload are big factors, new study finds.

Most users know its risky to reuse passwords, but 61% of them do so anyway, a new study found.
The new survey released this week from security vendor LastPass takes a new tack by breaking down the psychology of user behavior, which includes some combination of willful ignorance, denial, and risk-taking with how they handle passwords.
Try as they might, the security industry continues to struggle with password protection and how to change users behavior that puts them at risk.
The challenges of password protection are very much in the air right now.
Yahoo confirmed last week
that 500 million email accounts (and passwords) had been compromised. And today the White House and the National Cyber Security Alliance launched the
Lock Down Your Login
initiative pushing multi-factor authentication as the best way for consumers to protect themselves online. The public-private partnership includes Google, PayPal, MasterCard, Intel, Wells Fargo, Visa, Mozilla, and others.
Working with Lab42, LastPass surveyed 2,000 adults from the US, Germany, France, New Zealand, Australia, and the UK about their password habits, their beliefs and their understanding of what secure online behavior looks like. And in a nutshell, they found that while users know what safe passwords are, they tend to ignore this knowledge in favor of something thats easy to remember.
Among other key findings from the
LastPass survey
:
-- 91% know its risky to reuse passwords, but 61% do it anyway
-- The top reason users change passwords is because theyve forgotten it; only 29% do so for security reasons.
--Users are most protective of their online financial accounts (69%), followed by retail (43%), social media (31%), and entertainment (20%).
A users personality may also determine why they get hacked, LastPass says, and they rationalize dangerous or counter-intuitive behavior.
Almost half of survey respondents identifying as Type A personalities did not believe that they are at an increased risk by reusing passwords because of their own proactive efforts, which implies their behavior stems from their need to be in control, LastPass said in a statement. In contrast, more than half of respondents who identify as a Type B personality believe they need to limit their online accounts and activities due to fear of a password breach. By convincing themselves that their accounts are of little value to hackers, they are able to maintain their casual, laid-back attitude towards password security.
The password security problem is large and persistent. The ID Theft Resource Center reported nearly 800 data breaches in the US in 2015, exposing more than 169 million records. Compromised passwords were the port of entry for many of these attacks, according to the
Verizon 2016 Data Breach Investigations Report
.
And while infosec professionals and security consultants relentlessly warn against password reuse and encourage strong, unique passwords, the LastPass data suggests a fair amount of overwhelm and even resignation on the part of users.
People really are overwhelmed and feeling helpless, where password security is concerned, says Mark Burnett, security consultant and author of
Perfect Passwords
. Passwords have reached the limit of their usefulness, but business and consumers still need the secrecy aspect, he adds. Smarter authentication may strengthen security but is also difficult to manage.
While Burnett thinks multi-factor authentication works well, he points to the cost of hardware tokens and how businesses handle their loss, theft and replacement as potential drawbacks.
What we really need is flexible authentication that uses multiple methods, like a token when youre at computer and something else for your smartphone, Burnett adds. We need something that looks at multiple factors like time of day youre logging in or recognizes suspicious activity.
He points to FIDO-based
universal two-factor authentication
(U2F) as one possible fix, supported by Google, Dropbox, and others.
Related Content:
7 Ways To Charm Users Out of Their Passwords
7 Ways To Lock Down Your Privileged Accounts
Yahoo Confirms August Data Dump Issue Unrelated To Breach Of 500 Million Users

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
The Real Reasons Why Users Stink At Passwords