Work

“Protect Me Tomorrow”: Commitment Nudges to Remedy Compromised Passwords

Year: 2024

Type: article

Abstract: Internet users often neglect important security actions (e.g., installing security updates or changing passwords) because they interrupt users’ main task at inopportune times. Commitment devices, such as reminders and promises, have been found to be effective at reducing procrastination in other domains. In a series of online experiments ( \(n{\gt}3{,}000\) ), we explored the effects of reminders and promises on users’ willingness to change a compromised password. We find that adding an option to delay the task increases the share of people willing to eventually change their password considerably. Critically, the option to delay yields this overall increase without reducing the share of people choosing to change their password immediately. Additionally, most participants who promised to change their password later, or asked to be reminded to do so, indeed followed through on their commitment, leading to a net positive effect. Reminding participants of their previous commitment further increased this effect.

Source: ACM Transactions on Computer-Human Interaction

DOI: 10.1145/3689038

Authors: Eyal Peer, Alisa Frik, Conor Gilsenan, Serge Egelman

Institutions: Hebrew University of Jerusalem, International Computer Science Institute, University of California, Berkeley

Language: English

Topic: User Authentication and Security Systems

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Funder: National Science Foundation

Award: SaTC: NSF-BSF: CORE: Small: Increasing Users' Cyber-Security Compliance by Reducing Present Bias