Premium
If it is easy to remember, then it is not secure: Metacognitive beliefs affect password selection
Author(s) -
Luna Karlos
Publication year - 2019
Publication title -
applied cognitive psychology
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.719
H-Index - 100
eISSN - 1099-0720
pISSN - 0888-4080
DOI - 10.1002/acp.3516
Subject(s) - password , cognitive password , metacognition , selection (genetic algorithm) , affect (linguistics) , psychology , character (mathematics) , password policy , password strength , computer security , computer science , internet privacy , social psychology , one time password , cognition , artificial intelligence , communication , neuroscience , geometry , mathematics
Summary In this research, we applied current theories of metacognition to study computer security and tested the idea that users' password selection is affected by the metacognitive belief that if a password is memorable, then it is not secure. In two experiments, different types of eight‐character passwords and longer, more secure sentences were presented. Participants rated perceived memorability and perceived security of the passwords and indicated whether they would use them in a critical and in a noncritical service. The results confirmed the belief. Sentences that are in fact highly secure and perceived as highly memorable were also perceived as weak passwords. The belief strongly affected password selection for critical services, but it had no effect on noncritical services. In sum, long sentences are a particularly interesting type of password because they meet both security and memorability criteria, but their use is limited by a false belief.