ITL- Usability of Passwords

NIST Generic Clearance for Usability Data Collections

0693-0043password_survey_personal_April10 2014

ITL- Usability of Passwords

OMB: 0693-0043

⚠️ Notice: This form may be outdated. More recent filings and information on OMB 0693-0043 can be found here:

Document [docx]

Download: docx | pdf

Personal Password Usability Survey

This collection of information contains Paperwork Reduction Act (PRA) requirements approved by the Office of Management and Budget (OMB). Notwithstanding any other provisions of the law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with, a collection of information subject to the requirements of the PRA unless that collection of information displays a currently valid OMB control number. Public reporting burden for this collection is estimated to be 30 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed and completing and reviewing the collection of information. Send comments regarding this burden estimate or any aspect of this collection of information, including suggestions for reducing this burden, to the National Institute of Standards and Technology, Attn: Mary Theofanos, NIST Information Technology Laboratory, 100 Bureau Drive, MS 8940, Gaithersburg, MD, 20899-8940; email: mary.theofanos@nist.gov; telephone: 301-975-5889

OMB Control No. 0693-0043

Expiration Date: 10-31-2016

The usability scientists are conducting an independent research project on password usability. Passwords are the source of many cartoons and office jokes. These cartoons and jokes are not based on good scientific data but rather on anecdotal evidence.

This survey asks questions about accounts and passwords that you use personally, outside of your work. We don’t want your actual passwords. We do want to understand:

- how many personal accounts and passwords you have

- what strategies you use to create and manage your passwords

- your opinions on the password requirements for those accounts.

Your input will help us to provide a sound scientific basis that can inform password policies in the future. The results of this survey will be used to improve the usability of passwords and the login process. Thank you for your help!

Taking the survey is completely voluntary and anonymous. No personally identifiable information will be collected.

It takes about 30 minutes to complete the survey.

Please use the “Next” or “Back” button at the bottom of each page to navigate within the survey.

All questions are optional.

About your personal accounts

Before you begin, please think about all of your personal, not work-related, accounts (including computers) that require logins.

1. Do you have personal accounts in the categories listed below that require a password? If yes, enter the number of accounts in that category and select how often you use those accounts; if no, select “Never.”

	Number of accounts	Several times a day	About once a day	Several times a week	About once a week	Several times a month	Several times a year	Never
Email	______
Personal computers requiring passwords	______
Mobile devices requiring passwords (e.g., smartphones, tablets)	______
Social Networks (e.g., Facebook, MySpace, Twitter)	______
Online Chat/Instant Messaging	______
Banking online	______
Bill payment online	______
Shopping online	______
Financial management online (e.g. investment, 401K)	______
Healthcare management online (e.g. health insurance, Medicare)	______
Classifieds/auctions online (e.g. Craigslist, ebay)	______
Entertainment online (e.g. music, videos/movies)	______
Games online	______
News online	______

If you have other personal accounts not listed above, please describe the nature of the account(s): _________________

2. How often do you use the same password for different personal accounts?

Never or almost never
Less than half of the time
About half of the time
More than half of the time
Always or almost always

Comments: _________________

Questions about Passwords for Personal Email

3. How many personal email accounts do you have? _____

4. What strategies do you use to create the passwords of your personal email accounts? (check all that apply)

Create from a password root, where a few characters are always the same (e.g., 2PwdRt&, PwdRt42%, or tXpwdRT@)
Let system assign password
Make minor change(s) to an existing password (e.g., %elvis1, #elvis2, or $elvis3)
Recycle old passwords (e.g., old passwords that are not in current password history)
Use a common name, word, or phrase (e.g., Boston12)
Use a meaningful or pronounceable mnemonic (e.g., 2beOrnOt@toBee from “to be or not to be”)
Use a random combination of words, letters, or characters
Use character repetitions (e.g. !!!AAAbbb999)
Use existing passwords from other accounts
Other –describe strategies generically. Do not provide an example of an actual password or enough information to guess your password ______________

5. How important are these considerations to you when you create the password of a personal email account?

	Not at all Important	Only a little Important	Somewhat Important	Very Important
Easy to enter/type
Easy to remember
Strong, i.e., hard to guess/crack
Synchronized with passwords for other accounts
Compliant with the password requirements

Comments: _________________

6. How do you keep track of the passwords of your personal email accounts? (check all that apply)

Memorize the passwords
Let browser/computer auto-fill
Use mnemonics, e.g. meaningful or pronounceable phrase
Rely on hints provided by the computer
Do not track, use “forgot password” feature
Share with someone (e.g., a family member or friend)
Write entire password down on paper and place in a non-locked location
Write entire password down on paper and store securely in a locked location
Write down on paper, but disguise in some way (e.g. only write down the common word without the special characters)
Save in a document/file, protected with encryption or password
Save in a document/file, not protected (i.e. without encryption or password)
Use password management software
Store in unencrypted electronic devices, e.g., USB key, PDA, cell phone, etc.
Store in encrypted electronic devices, e.g. BlackBerry
Other – please describe _________________

7. In your opinion, how secure are the passwords of your personal email accounts?

Not at all secure, i.e. very easy to guess/crack
Slightly secure
Moderately secure
Very secure
Completely secure, i.e. extremely hard to guess/crack
Don’t know

8. In general, what do you think of the password requirements for your personal email accounts?

(e.g., password length, use of special characters, password expiration, etc.)

Password length - minimum number of characters required

Too short
About right
Too long
Don’t know/No opinion

In your opinion, what should the length of your personal email passwords be? (e.g. , 6, 8, or 12 characters, etc.) _________________

Complexity of the password requirements – combination of letters, numbers, and special characters

Too complex
About right
Too simple
Don’t know/No opinion

Comments: _________________

Password expiration- how often do you need to change the passwords of your personal email accounts?

30 days or less
31 - 60 days
61 - 90 days
91 - 120 days
121 - 180 days
181 days or more
Change only as needed (e.g., new accounts, or accounts hacked, etc.)

In your opinion, how many days, weeks, or months should a personal email password last before it expires and you have to change it? _________________

9. What consequences, do you think, would there be if the passwords of your personal email accounts were compromised?

__________________________________________________________________________

Questions about Passwords for Personal Computers requiring passwords