ITL-CSD- Password Generation Study

National Institute of Standards and Technology (NIST)

Information Technology Laboratory (ITL)

Computer Security Division (CSD)

Password Generation Study Post-Task Questionnaire

About the Password Generation Study

1. How would you rate the experience of generating passwords to satisfy the password requirements?

a. “password requirement set 1”

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

b. “password requirement set 2”

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

2. How would you rate the strength (i.e., in protecting the account) of the password requirements?

a. “password requirement set 1”

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

b. “password requirement set 2”

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

3. For the password you selected for “account type 1,” please rate:

a. The strength (i.e., in protecting the account) of the password

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

b. The ease of remembering the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

c. The ease of typing the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

4. For the password you selected for “account type 2,” please rate:

a. The strength (i.e., in protecting the account) of the password

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

b. The ease of remembering the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

c. The ease of typing the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

5. For the password you selected for “account type 3,” please rate:

a. The strength (i.e., in protecting the account) of the password

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

b. The ease of remembering the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

c. The ease of typing the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

6. For the password you selected for “account type 4,” please rate:

a. The strength (i.e., in protecting the account) of the password

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

b. The ease of remembering the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

c. The ease of typing the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

7. For the password you selected for a desktop computer, please rate:

a. The strength (i.e., in protecting the account) of the password

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

b. The ease of remembering the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

c. The ease of typing the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

8. For the password you selected for a mobile computing device, please rate:

a. The strength (i.e., in protecting the account) of the password

1	2	3	4	5
Very Weak	Weak	Neutral	Strong	Very Strong

b. The ease of remembering the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

c. The ease of typing the password

1	2	3	4	5
Very Difficult	Difficult	Neutral	Easy	Very Easy

9. What, if any strategies, did you use to generate the passwords in this study?

_________________________________________________________________

About yourself and your experience with passwords

1. Gender:

• Male

• Female

2. Age: ______ (in years)

3. Highest education (degree/level attained):

• High school or equivalent

• Associate degree

• Bachelor’s degree

• Master’s degree (e.g. MS, MA, etc.)

• Doctoral degree (e.g. PhD)

• Professional degree (e.g. MD, JD, etc.)

• (Other), please specify _____________________

4. Occupation: _______________________

5. Your level of experience using computers:

• Novice

• Average

• Advanced

• Expert

6. Do you have personal accounts in the categories listed below that require a password? If yes, enter the number of accounts in that category and select how often you use those accounts.

	Number of accounts	Several times a day	About once a day	Several times a week	About once a week	Several times a month	Several times a year
Email
Personal computers requiring passwords
Mobile devices requiring passwords (e.g., smartphones, tablets)
Social Networks (e.g., Facebook, MySpace, Twitter)
Online Chat/Instant Messaging
Banking online
Bill payment online
Shopping online
Financial management online (e.g. investment, 401K)
Healthcare management online (e.g. health insurance, Medicare)
Classifieds/auctions online (e.g. Craigslist, ebay)
Entertainment online (e.g. music, videos/movies)
Games online
News online

If you have other personal accounts not listed above, please describe the nature of the account(s): _______________________________

7. How often do you use the same password for different personal accounts?

• Never or almost never

• Less than half of the time

• About half of the time

• More than half of the time

• Always or almost always

8. Tell us about any overall strategy you use to manage your passwords for different personal accounts.

(An example of such strategy is to have 3 passwords with different security levels: a strong password for accounts with great importance to you; a medium-strength password for less important accounts; and a low-strength password for accounts that are more casual.)

________________________________________________________________________

9. What strategies do you use to create the passwords of your personal accounts? (check all that apply)

• Create from a password root, where a few characters are always the same (e.g., 2PwdRt&, PwdRt42%, or tXpwdRT@)

• Let system assign password

• Make minor change(s) to an existing password (e.g., %elvis1, #elvis2, or $elvis3)

• Recycle old passwords (e.g., old passwords that are not in current password history)

• Use a common name, word, or phrase (e.g., Boston12)

• Use a meaningful or pronounceable mnemonic (e.g., 2beOrnOt@toBee from “to be or not to be”)

• Use a random combination of words, letters, or characters

• Use character repetitions (e.g. !!!AAAbbb999)

• Use existing passwords from other accounts

• Other –describe strategies generically. Do not provide an example of an actual password or enough information to guess your password. ______________

10. How important are these considerations to you when you create the password of a personal email account?

	Not at all Important	Only a little Important	Somewhat Important	Very Important
Easy to enter/type
Easy to remember
Strong, i.e., hard to guess/crack
Synchronized with passwords for other accounts
Compliant with the password requirements

11. How do you keep track of the passwords of your personal accounts? (check all that apply)

• Memorize the passwords

• Let browser/computer auto-fill

• Use mnemonics, e.g. meaningful or pronounceable phrase

• Rely on hints provided by the computer

• Do not track, use “forgot password” feature

• Share with someone (e.g., a family member or friend)

• Write entire password down on paper and place in a non-locked location

• Write entire password down on paper and store securely in a locked location

• Write down on paper, but disguise in some way (e.g. only write down the common word without the special characters)

• Save in a document/file, protected with encryption or password

• Save in a document/file, not protected (i.e. without encryption or password)

• Use password management software

• Store in unencrypted electronic devices, e.g., USB key, PDA, cell phone, etc.

• Store in encrypted electronic devices, e.g. BlackBerry

• Other – please describe _________________

12. In the past 6 months, how much frustration have these problems with your personal accounts caused you?

	None	A little	Some	A lot
Forgetting your User name or ID
Forgetting your password
Forgetting your PIN
Forgetting which password goes with which account
Getting locked out of an account
Mistyping a password
Getting error messages when trying to change a password
Getting error messages when trying to recover a password
Dealing with slow or unhelpful system support
Valid password rejected for unclear reason
Other, please describe below

If “Other”, describe problem(s): ___________________

13. In your opinion, how many characters long should personal account passwords be? Please give a whole number. _________________

14. How do you feel about the amount of effort it takes you to create and manage passwords to do what you want to do online?

_________________________________________________________________________________

NOTE: This survey contains collection of information requirements subject to the Paperwork Reduction Act.  Notwithstanding any other provision of the law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with, a collection of information subject to the requirements of the Paperwork Reduction Act, unless that collection of information displays a currently valid OMB control number.  The estimated response time for this survey is 25 minutes.  The response time includes the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information."  Send Comments regarding this estimate or any other aspects of this collection of information, including suggestions for reducing the length of this questionnaire, to the National Institute of Standards and Technology, Attn., Mary Theofanos, at mary.theofanos@nist.gov

OMB Control No. 0693-0043   Expiration Date: 3/31/2016 

15