Archived.pdf

Recent studies indicate that users have difficulties managing online passwords, leading to insecure practices like weak passwords and password reuse. This is exacerbated by varying password policy requirements for similar services. The study investigates password policies and authentication frameworks, finding that they cause usability problems by not considering authentication assurance levels and specifying diverging requirements for similar services. A unified standard password policy is proposed to address these issues. Users often adopt strategies to simplify password management, such as reusing passwords, which can cause security vulnerabilities. Educating users to never reuse passwords is unlikely to succeed, and instead, users should be encouraged to reuse passwords for low-sensitivity applications and avoid reusing them for high-sensitivity ones. Inadequate password policies can lead to insecure practices, and strict policies can force users to choose simple passwords, creating a vicious circle. Single Sign-On (SSO), Reduced Sign-On (RSO), and federated identity management are promoted to solve identity overload and password fatigue but are unlikely to solve the problem entirely. Local password management software can provide usability benefits but also poses security risks.