DeepAI AI Chat
Log In Sign Up

(How) Do people change their passwords after a breach?

by   Sruti Bhagavatula, et al.

To protect against misuse of passwords compromised in a breach, consumers should promptly change affected passwords and any similar passwords on other accounts. Ideally, affected companies should strongly encourage this behavior and have mechanisms in place to mitigate harm. In order to make recommendations to companies about how to help their users perform these and other security-enhancing actions after breaches, we must first have some understanding of the current effectiveness of companies' post-breach practices. To study the effectiveness of password-related breach notifications and practices enforced after a breach, we examine—based on real-world password data from 249 participants—whether and how constructively participants changed their passwords after a breach announcement. Of the 249 participants, 63 had accounts on breached domains; only 33 63 changed their passwords and only 13 the announcement. New passwords were on average 1.3x stronger than old passwords (when comparing log10-transformed strength), though most were weaker or of equal strength. Concerningly, new passwords were overall more similar to participants' other passwords, and participants rarely changed passwords on other sites even when these were the same or similar to their password on the breached domain. Our results highlight the need for more rigorous password-changing requirements following a breach and more effective breach notifications that deliver comprehensive advice.


Rules of Engagement: Why and How Companies Participate in OSS

Company engagement in open source (OSS) is now the new norm. From large ...

Theory-based Habit Modeling for Enhancing Behavior Prediction

Psychological theories of habit posit that when a strong habit is formed...

The Nudging Effect on Tracking Activity

Wearables activity trackers are becoming widely adopted to understand in...

A Mixed-method Study on Security and Privacy Practices in Danish Companies

Increased levels of digitalization in society expose companies to new se...

What breach? Measuring online awareness of security incidents by studying real-world browsing behavior

Awareness about security and privacy risks is important for developing g...

Automating the Communication of Cybersecurity Knowledge: Multi-Case Study

Cybersecurity is essential for the protection of companies against cyber...

Prospects for Improving Password Selection

User-chosen passwords remain essential to online security, and yet peopl...