Systematic overview of password security problems

Abstract

Alphanumeric passwords are the first line of defense in security for most information systems. Morris and Thompson identified passwords as a weak point in an Information System’s security, 35 years ago. Their findings showed that 86% of the passwords were too short, contained lowercase letters only, digits only, were easily found in dictionaries and/or easily compromised. The objective of this paper is to perform a systematic literature review in the area of passwords and passwords security, in order to determine whether alphanumeric passwords are still weak, short and simple. The results show that only 42 out of 63 relevant studies propose a solid solution to deal with the identified problems with alphanumeric passwords, but only 17 have statistically verified it. We find that only 3 studies have a representative sample, which may indicate that the results of the majority of the studies cannot be generalized. We conclude that users and their alphanumeric passwords are still the “weakest link” in the “security chain”. Careless security behavior, involving password reuse, writing down and sharing passwords, along with an erroneous knowledge concerning what constitutes a secure password, are the main problems related to the issue of password security.