Factors Influencing Password Reuse: A Case Study

9 Pages Posted: 19 Mar 2018 Last revised: 17 Aug 2018

See all articles by Jacob Abbott

Jacob Abbott

Indiana University Bloomington - School of Informatics, Computing, and Engineering

Daniel Calarco

Independent

L. Jean Camp

Indiana University Bloomington - School of Informatics and Computing

Date Written: March 16, 2018

Abstract

Passwords are the primary and widely used single and multiple point authentication scheme adapted across the globe. However, implemented password practices and policies varies across different platforms which creates potential security vulnerabilities. For our research, we studied the password policies of twenty-two universities and analyzed 1.3 billion email addresses and passwords obtained from Exploit.in and Anti-Public combination lists. We analyzed the potential reusability of the students, staffs, faculty, and other associated users' credentials for each of the universities' domains and checked whether they meet the specific requirements of each password policy. Through our analysis, we found several policy decisions adopted by educational institutes that may decrease security related to account credentials and make actionable recommendations for patching such security loopholes. We aim at limiting the reuse of passwords by implementing adaptive policies which will enable protection of data theft across any educational institute wide network. Our recommendations can be generalized to improve the policies adapted by several organizations in general, especially with accounts that are deemed to be highly valued, ex. email, banking, medical portal, etc.

Keywords: Passwords, Policies, Requirements, Reuse

Suggested Citation

Abbott, Jacob and Calarco, Daniel and Camp, L. Jean, Factors Influencing Password Reuse: A Case Study (March 16, 2018). TPRC 46: The 46th Research Conference on Communication, Information and Internet Policy 2018. Available at SSRN: https://ssrn.com/abstract=3142270

Jacob Abbott (Contact Author)

Indiana University Bloomington - School of Informatics, Computing, and Engineering ( email )

100 South Indiana Ave.
Bloomington, IN 47405
United States

Daniel Calarco

Independent ( email )

No Address Available

L. Jean Camp

Indiana University Bloomington - School of Informatics and Computing ( email )

901 E 10th St
Bloomington, IN 47401
United States

Register to save articles to
your library

Register

Paper statistics

Downloads
217
Abstract Views
793
PlumX Metrics