The password practices applied by South African online consumers: Perception versus reality

Rika Butler,Martin Butler

doi:10.4102/sajim.v17i1.638

Abstract

Background: The ability to identify and authenticate users is regarded as the foundation of computer security. Although new authentication technologies are evolving, passwords are the most common method used to control access in most computer systems. Research suggests that a large portion of computer security password breaches are the result of poor user security behaviour. The password creation and management practices that online consumers apply have a direct effect on the level of computer security and are often targeted in attacks. Objectives: The objective of this study was to investigate South African online consumers’ computer password security practices and to determine whether consumers’ perceptions regarding their password security ability is reflected in the password creation and management practices that they apply. Method: A Web-based survey was designed to (1) determine online consumers’ perceptions of their skills and competence in respect of computer password security and (2) determine the practices that South African online consumers apply when creating and managing passwords. The measures applied were then compared to (1) the users’ perceptions about their computer password security abilities and (2) the results of international studies to determine agreement and inconsistencies. Results: South African online consumers regard themselves as proficient password users. However, various instances of unsafe passwords practices were identified. The results of this South African study correspond with the results of various international studies confirming that challenges to ensure safe online transacting are in line with international challenges. Conclusion: There is a disparity between South African online consumers’ perceived ability regarding computer password security and the password creation and management practices that they apply.

Highlights

The ability to identify and authenticate users is regarded as the foundation of computer security
The majority of South African online consumers feel that they are proficient Internet users who are able to apply proper password practices, the results from the survey clearly indicate that users tend to apply unsafe password creation and management practices and are not as skilled as they may perceive themselves to be
Despite the fact that users’ perceived ability indicated that they are able to create strong passwords and that strength was considered an important aspect when creating new passwords, this study found that respondents apply unsafe password creation practices

Summary

Background

The ability to identify and authenticate users is regarded as the foundation of computer security. New authentication technologies are evolving, passwords are the most common method used to control access in most computer systems. Research suggests that a large portion of computer security password breaches are the result of poor user security behaviour. The password creation and management practices that online consumers apply have a direct effect on the level of computer security and are often targeted in attacks

Objectives

Results

Conclusion

Methodology

Findings and discussion of results