Factors Influencing Password Reuse: A Case Study

Abstract

Passwords are the primary and widely used single and multiple point authentication scheme adapted across the globe. However, implemented password practices and policies varies across different platforms which creates potential security vulnerabilities. For our research, we studied the password policies of twenty-two universities and analyzed 1.3 billion email addresses and passwords obtained from Exploit.in and Anti-Public combination lists. We analyzed the potential reusability of the students, staffs, faculty, and other associated users' credentials for each of the universities' domains and checked whether they meet the specific requirements of each password policy. Through our analysis, we found several policy decisions adopted by educational institutes that may decrease security related to account credentials and make actionable recommendations for patching such security loopholes. We aim at limiting the reuse of passwords by implementing adaptive policies which will enable protection of data theft across any educational institute wide network. Our recommendations can be generalized to improve the policies adapted by several organizations in general, especially with accounts that are deemed to be highly valued, ex. email, banking, medical portal, etc.