Slashdot Mirror
Survey Shows How Stupid People Are With Passwords
wiredmikey writes "Another study was released to today that once again shows how careless people really are online. When it comes to safeguarding personal information online, many people don't seem to care very much, or don't think enough about it. In the survey of more than 2,500 people, some interesting and scary trends were revealed in how users handle their online passwords..."
From TFA:
" 30 percent logged into a site requiring a password over public WiFi (vs. 21 percent overall)"
So what? thats what SSL and Certificates are for. Entering your password in a public computer - well, thats another story.
For example, the article asserts that 4 out of 10 people have shared a password in the last year. I've done that. I shared the password to one of my email accounts with my twin who needed access. And after he was done I changed the password. Much of the data here is very hard to actually show is bad without more context for what exactly people were doing. Also, while we're discussing these issues, obligatory xkcd - http://xkcd.com/792/.
Also, regarding: "And 30 percent remember their passwords by writing them down and hiding them somewhere like a desk drawer."
I think writing down your password isn't that bad of a choice (especially for online passwords, not the one that logs you into your computer).
I'm not the only one who thinks that way: http://www.schneier.com/blog/archives/2005/06/write_down_your.html
So, what, we're supposed to have a different password with special characters and nothing significant to us (like dates) for each of the 150 online accounts we have? Oh, and if we write down the passwords somewhere so we don't forget them we're dumb too? Whatever! Maybe if we all had photographic memories that would be a realistic options, but there's just no way it's going to happen like that.
It's just a crappy system, we should be using public key encryption with our private keys stored on a USB key - or some other similar scheme, where we don't have to memorize a million randomized passwords in order to not have our identity stolen.
4 in 10 respondents shared passwords with at least one person in the past year.
> 4 in 10 are married?
Nearly as many people use the same password to log into multiple Web sites, which could expose their information on each of the sites if one of them becomes compromised. (A separate recent study revealed that 75% of people use the same password for Social Networking Sites and their email accounts)
> If I have a hotmail account and a twitter account, which I never use, should I create strong, unique passwords for both? Why?
Almost half of all users never use special characters (e.g. ! ? & #) in their passwords, a simple technique that makes it more difficult for criminals to guess passwords.
> Examples of weak passwords: Pingeico4 due7Johh Eexee9ot Soobanah6 Ja3sahte
2 in 10 have used a significant date, such as a birth date, or a pet's name as a password – information that's often publicly visible on social networks.
> Some people have disposable passwords for useless login credentials. A New York Times account doesn't require a strong password.
Most of these conclusions are neither scary nor stupid.
Yeah, it depends on what you're protecting against. If the purpose of online passwords is primarily to prevent other online users from accessing your account, then writing the password down in a notebook on your desk is safe. Insofar as the purpose is to protect your account from someone who has access to your desk, it's not safe.
It's important to remember that security depends on context.
Users are careless with their workplace computers because it's not their data and they don't care what happens to it.
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
The problems with variable password rules makes it harder to create password systems. More importantly, usually we don't really need one. Really, is there any need for a site like moviefone to have a password? I mean really, it's a freaking movie website list. Let them track you with a cookie, not a login and a password. I don't agree to give my credit card number to my grocery store permanently just to get "one click" payout, what possibly reason would I do it for a freakin movie ticket. Honestly, even slashdot could work almost as well without a real password. Just set it up so that it has a username that does not show the last 4 letters, and the only way to change the password is by asking them to send a reset to the email account you signed up in. A 4 letter password plus an email reset would work fine for something as unimportant as tech news site with commenting. I mean really, would it be that horrible if someone stole your slashdot identity? It's not a bank account for god's sake. Or set it up with a camera ID system.
excitingthingstodo.blogspot.com
Considering this "article" also rails on people for not using a different password on every website, I don't know what he expects people to do with them.
When you throw 100 passwords at people and want to enforce "strong" passwords on all of them (which he also complains about), what option do people have but to store them somewhere? Paper is a useful media for this purpose.
This article is bullshit, really. Some of the things he complains about are the direct cause of other things he complains about. Make up your fucking mind.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
perhaps young people do understand online security better. . . http://news.slashdot.org/story/10/03/16/1931214/Users-Rejecting-Security-Advice-Considered-Rational
Thanks for the link. The article is interesting. However...
Most of the supposed sins highlighted in the article are junk.
That's not what the article from your link says. I quote from it:
While we argue that it is rational for users to ignore security advice this does not mean that the advice is bad. In fact much, or even most of it is beneficial. It's better for users to have strong passwords than weak ones, to change them often, and to have a different one for each account. That there is benefit is not in question. However, there is also cost, in the form of user effort.
In other words, the linked article is about why users may be acting in a rational manner (in economic terms) by ignoring security advice, not that the advice is "junk." Getting fire insurance is also a waste of time and money for most people (and perhaps not getting it could be considered a "rational" decision according to some economic logic), but if your house burns down, you might have some real problems.
The reality is that people who better understand online security find that there are plenty of solutions out there to make their lives as easy (if not easier) than those who engage in bad security practices. Just because you don't reuse passwords doesn't mean you have to have them all memorized, for example. There are effective ways to manage such things without a high user cost in time and effort.
If people understood online security better, they'd make use of such technological solutions to be both safe and efficient. That's not what TFA says, though.
For example most of the people I know (I fit in the younger generation category) have four to five passwords. They have a common trash password for sites they don't really care about being compromised (say slashdot). Than a different one for ones with personal data, but nothing critical. And than separate ones for email and financial stuff. Yes they share passwords between sites, yes they share passwords with loved ones (duh). But this is all done in a "smart" manner, not a dumb one.
When I was 15 I figured out my first law of nature. Said law is, "People are generally stupid."
In the 27 years since I first figured that out, I have seen no evidence to the contrary.
Looks like Mark Twain was a bit faster than you.
Quoting him:
"When I was a boy of 14, my father was so ignorant I could hardly stand to have the old man around. But when I got to be 21, I was astonished at how much the old man had learned in seven years."