If it is easy to remember, then it is not secure: Metacognitive beliefs affect password selection

If it is easy to remember, then it is not secure: Metacognitive beliefs affect password selection. Karlos Luna. Applied Cognitive Psychology, https://doi.org/10.1002/acp.3516

Summary: In this research we applied current theories of metacognition to study computer security and tested the idea that users’ password selection is affected by the metacognitive belief that if a password is memorable, then it is not secure. In two experiments, different types of eight‐character passwords and longer, more secure sentences were presented. Participants rated perceived memorability and perceived security of the passwords and indicated whether they would use them in a critical and in a non‐critical service. The results confirmed the belief. Sentences that are in fact highly secure and perceived as highly memorable were also perceived as weak passwords. The belief strongly affected password selection for critical services, but it had no effect on non‐critical services. In sum, long sentences are a particularly interesting type of password because they meet both security and memorability criteria, but their use is limited by a false belief.