Section 7.3. Experimental Study

7.3. Experimental Study

To investigate the tradeoff between security and memorability in a real-world context, we conducted an experiment involving 400 first-year students at the University of Cambridge. The experiment compared the effects of giving three alternative forms of advice about password selection, and measured the effect that this advice had on the security and memorability of passwords.

The experimental subjects were students who had arrived to start a degree in our School of Natural Sciences, which includes physics, chemistry, geology, and materials science. All Natural Sciences students are provided with an account on a central computing facility, using a user ID and a randomly generated initial password. They also have access to a number of other facilities. At the time they receive these account details, students are generally advised to select their own password. Some students receive this advice informally from a computer officer in their department or hall of residence. Many students attend an introductory lecture to learn about the central facilities, followed by a tutorial session under the supervision of demonstrators.