Hierarchy of users׳ web passwords: Perceptions, practices and susceptibilities - Taiabul Haque, S.M.; Wright, Matthew; Scielzo, Shannon (International journal of human-computer studies, 2014)
In this study, we propose a hierarchy of password importance, and we use an experiment to examine the degree of similarity between passwords for lower-level (e.g. news portal) and higher-level (e.g. banking) websites in this hierarchy. We asked subjects to construct passwords for websites at both levels. Leveraging the lower-level passwords along with a dictionary attack, we successfully cracked almost one-third of the subjects׳ higher-level passwords. In a survey, subjects reported frequently reusing higher-level passwords, with or without modifications, as well as using a similar process to construct both levels of passwords. We thus conclude that unsafely shared or leaked lower-level passwords can be used by attackers to crack higher-level passwords. •We propose and verify a theoretical model of a hierarchy of users׳ passwords.•We examine the degree of similarity between lower-level and higher-level passwords.•Semantic similarity is more commonly used than syntactic similarity.•We crack one-third of users׳ higher-level passwords by leveraging lower-level ones.•Our findings highlight the indirect consequences of password sharing.