Improving Password Cyber-Security Through Inexpensive and Minimally Invasive Means: Detecting and Deterring Password Reuse Through Keystroke-Dynamics Monitoring and Just-in-Time Fear Appeals
Information Technology for Development, vol. 20(2), pp. 196–213
31 Pages Posted: 12 Jul 2013 Last revised: 8 Jun 2014
Date Written: April 28, 2014
Password reuse — using the same password for multiple accounts — is a prevalent phenomenon that can make even the most secure systems vulnerable. When passwords are reused across multiple systems, hackers may compromise accounts by stealing passwords from low-security sites to access sites with higher security. Password reuse can be particularly threatening to users in developing countries in which cyber-security training is limited, law enforcement of cyber-security is non-existent, or in which programs to secure cyberspace are limited. This article proposes a two-pronged solution for reducing password reuse through detection and mitigation. First, based on the theories of routine, cognitive load, and motor movement, we hypothesize that password reuse can be detected by monitoring characteristics of users’ typing behavior (i.e., keystroke dynamics). Second, based on protection motivation theory, we hypothesize that providing just-in-time fear appeals when a violation is detected will decrease password reuse. We tested our hypotheses in an experiment and found that users’ keystroke dynamics are diagnostic of password reuse. By analyzing changes in typing patterns, we were able to detect password reuse with 81.71% accuracy. We also found that just-in-time fear appeals decrease password reuse; 88.41% of users who received a fear appeal subsequently created unique passwords, whereas only 4.45% of users who did not receive a fear appeal created unique passwords. Our results suggest that future research should continue to examine keystroke dynamics as an indicator of cyber-security behaviors, and use just-in-time fear appeals as a method for reducing non-secure behavior. The findings of our research provide a practical and cost-effective solution to bolster cyber-security through discouraging password reuse.
Keywords: password reuse, keystroke dynamics, protection motivation theory, just-in-time fear appeals, support vector machine, cyber-security, developing countries
Suggested Citation: Suggested Citation