Rethinking user password management
Abstract
This paper critically examines the continued reliance on passwords despite its flaws. It explores how the inherent cognitive limitations of users — exemplified by Miller’s Law and the challenges of short-term memory — contribute to insecure practices such as password reuse and reliance on easily remembered, yet predictable, password structures. The paper reviews historical and contemporary research on user behaviour in password creation, highlighting how increasing complexity requirements often lead users to adopt counterproductive shortcuts and coping mechanisms. In addition to dissecting the cognitive challenges, the paper evaluates current security practices including multi-factor authentication (MFA) and highlights some prominent weaknesses. The paper proposes abandoning current password practices, which are user-centric, and adopting a new paradigm. In this model, principles are drawn from solutions in the privilege access management (PAM) and password manager realms to craft an architecture that balances security and convenience while eliminating cognitive burden. Readers will take away a comprehensive understanding of the limitations of traditional password systems, insights into modern authentication methods, and a roadmap for adopting more user-friendly and robust security practices that shift the responsibility of password complexity away from the end user. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
The full article is available to subscribers to the journal.
Author's Biography
Bryan Christ is an IT professional with almost three decades of industry experience. His fascination with technology started in the early 1980s with various models of the Commodore computer. He first published in 1991 and began his professional career a few years later. Along the way, he has worked for a number of high-profile companies including Compaq, Hewlett-Packard and MediaFire. Most of his career has been focused on open-source and software development opportunities with an emphasis on project management, team leadership and executive oversight. In addition to his work with Bravura Security, he continues to serve as CIO and Chief Technology Officer (CTO) in other endeavours.
