Password surveys are shit!

Per Thorsheim, a long-time organiser of the PasswordsCon event, argues that most password surveys give unreliable answers. He traces his interest to a consulting engagement years ago, where a quick guessing exercise against a large company's domain turned up an administrator account protected by the word "password".

Most of the talk is a live audience exercise. Attendees are asked how many passwords, unique passwords and accounts they have, and the speaker shows how each question is open to interpretation. People count only the accounts they use often, leave out loyalty programmes, work systems and PINs, and rarely know how many services they have signed up for. When people are asked to list every account they have ever created, the total tends to rise several times over. He also raises PIN habits, whether spaces are allowed in passphrases, and whether respondents understand two-step verification, which many do not.

He concludes that survey results are only meaningful when the exact wording, the interview method and the respondent's understanding are recorded. He proposes a shared core question set so that results can be compared across countries, ages and groups. In the Q&A he says he recommends password managers for many people but thinks a written list kept at home can be enough for low-risk users.