Blog archive
Example of a password strength meter

Those meters that rate password strength work, until they don't

We know the limitations of passwords: They are difficult to scale, and managing truly secure passwords is a headache for administrators and end users. We also know that although there are alternate technologies for online authentication, passwords probably are here to stay.

“Passwords are not going to disappear overnight, or in the next 10 years or 20 years,” said Lujo Bauer, assistant research professor in Carnegie Mellon University’s Electrical & Computer Engineering Department.

So how to make the best of what we are stuck with? One tool increasingly common on public- and private-sector websites are strength meters, an alternative to stringent password policies intended to nudge users toward better security by providing feedback when creating passwords. As a user creates a password, it provides feedback, such as whether the password is “weak,” “good” or “strong.”

But a study of these tools at Carnegie Mellon  suggests that you can only push users so far before you hit the point of diminishing returns.

Using the meters resulted in longer, sometimes better, passwords. But, “there seems to be a limit to the stringency that a user will tolerate,” researchers found. “Were meters too stringent, users might just give up.”

 Percentage of passwords broken after 5 trillion guesses

46.7% Created with no strength meter
39.4% Created with baseline strength meter
39.2% Created with meter requiring eight letters, numerals and characters for a top score
33.7% Created with a meter requiring 16 letters for a top score
26.3% Created with a meter awarding only half the score of other meters
27.9% Created with a meter awarding only one third the score of other meters

Source: How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation

The findings are significant not because they are unexpected — they’re not — but because this apparently is the first large-scale study of a technology that is widely used but not well understood.

Bauer and colleagues at Carnegie Mellon conducted the study with 2,931 subjects who created passwords on sites using one of 14 types of meters with different displays and criteria for determining strength. The only requirement was that the password be at least eight characters long. Strength was evaluated using a simulated password-guessing algorithm and the participants returned to the test site two days later to see how well they remembered their passwords.

All of the strength meters resulted in users creating longer, more complex passwords than those created on sites with no meter. But length does not equal strength. Only users at sites using two very stringent meters produced passwords that were significantly more difficult to break.

However, security reached a plateau on the site with the most stringent meter, which gave users very low scores — grading at a rate of one-third of other meters — and required more complexity to get a strong security rating. Apparently the higher requirements frustrated users who gave up trying to please the meter.

Interestingly, the ability to remember a password two days later did not vary significantly according to its strength.

The lesson: Don’t push users too far; take the annoyance factor into account when having users create new passwords.

Bauer, who studies access control systems, had some other practical recommendations for making the most of passwords:

  • Strong passwords do not have to be hard to use. Combinations of words — pass phrases — can provide a high level of security while being easy to remember.
  • Length is a more effective requirement for producing strong passwords than the use of numerals and special characters. Requiring 16 letters tends to produce a stronger password than requiring a combination of eight letters, numbers and other characters.
  • Instruction can have a significant impact on password strength. Explain to users why a strong password is needed and what makes it strong.

Posted by William Jackson on Jun 11, 2013 at 9:39 AM

Reader Comments

Wed, Jun 19, 2013 Cowboy Joe

So, the only way t' protect y'r data - aside from not puttin' it on the net in the first place - still seems t' be t' be so boring that nobody cares about y'r junk anyway. Nothin' difficult about that.

Wed, Jun 12, 2013 Brendan

"Where is the study of how deeply these attempts at fortifying security on the backs of legitimate users impedes productivity and efficiency?" Winner, Winner, Chicken Dinner!!! I am a local administrator in a small police department and between all of the software programs that require individual log-ins, I waste a considerable amount of time resetting them for our personnel. As I type this, I am staring at three of four sticky notes on my monitor which have a total of six passwords and sites written on them. The ones that bother me the most are the mandatory changing of passwords within a very short amount of time.

Wed, Jun 12, 2013

Where is the study of how deeply these attempts at fortifying security on the backs of legitimate users impedes productivity and efficiency?

Wed, Jun 12, 2013 RW-in-DC

Despite HSPD-12's requirement for a single card credential to prove identity, when looking at the Federal sites, eOPF, FedTraveler, and Agency-specific ones ALL have different requirements adding to Jeff's point about the growing edifices of sticky notes.

Wed, Jun 12, 2013 Cathy Chewelah, WA

Yay for the xkcd comic! I was going to post that but Chip beat me to it.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above


HTML - No Current Item Deck
  • Transforming Constituent Services with Business Process Management
  • Improving Performance in Hybrid Clouds
  • Data Center Consolidation & Energy Efficiency in Federal Facilities