If it is easy to remember, then it is not secure: Metacognitive beliefs affect password selection

Abstract

SummaryIn this research, we applied current theories of metacognition to study computer security and tested the idea that users' password selection is affected by the metacognitive belief that if a password is memorable, then it is not secure. In two experiments, different types of eight‐character passwords and longer, more secure sentences were presented. Participants rated perceived memorability and perceived security of the passwords and indicated whether they would use them in a critical and in a noncritical service. The results confirmed the belief. Sentences that are in fact highly secure and perceived as highly memorable were also perceived as weak passwords. The belief strongly affected password selection for critical services, but it had no effect on noncritical services. In sum, long sentences are a particularly interesting type of password because they meet both security and memorability criteria, but their use is limited by a false belief.