Abstract
Introduction
Experiment
Results
Discussion
Conclusions

Acknowledgements
References
Appendices
Credits
Feedback

Back To Main

Logins & Passwords - What Users Want

Introduction

A serious problem that faces many websites today is achieving a balance between the amount of information it wants to collect from a user and the inclination of the user to register with a website. Without personal user information such as age, gender, and occupation to "data-mine", the information a website collects on a user's spending habits and their preferences is not of much value. The more information collected from a user at registration, the more monetary value that can be mined from the data later. Furthermore, such a website must be able to provide security to registered users in the form of logins and passwords. The problem is that the more information that the website requests from a user, the more reluctant the user will be towards the registration process. A website may want to collect pages and pages of information, but a user will not want to go through the process of filling out pages and pages of information; in addition, many users would feel uncomfortable giving out a lot of information to various websites.

When using sites with an emphasis placed on security, users may be assigned usernames and passwords, which can also turn a user away from the registration process. Few things are more frustrating to users than finding sites that have interesting content and then not being able to access the information until registering with the site, especially if the site uses a lengthy, complex registration form. Sites that ask too much information can feel intrusive to us and often the annoyance factor of registering with a site will outweigh the perceived benefits of the site, such as content or access to services. How does a website get the information and security they want without frustrating the user? Many current websites are giving added incentives to encourage users to register. These registration incentives have included discounts, free shipping on e-commerce buys, or entries into sweepstakes. Adding these incentives increases the cost of user acquisition, which is a good thing.

According to the Forrester Report, "The Promotion Commotion"¹, sweepstakes and free prizes are among the most user and the most effective forms of marketing to draw in registered users. If these sites could find a way to gather the required information without frustrating the user, they would save a lot of money on user acquisition. There is also the fear that these added incentives might soon be expected of websites, which would lead to disappointment and anger when the promotions end.

If the user were more inclined to register with a site without incentives and bonuses being thrown at him, the problem would be solved. Changes in the presentation of a registration form may help. Splitting the form into multiple pages may ease the initial hesitation of a user to register, but might frustrate them when they get to the second page. If they thought they would only need to fill out the first page of information, having more than one page will most likely irritate them a great deal. However, since the users will already have invested time and effort in filling out the first page, they will be more likely to finish in order to reap the benefits of their efforts. Will adding detailed help and explanations on such registration pages ease the frustration of the user, or add to the complexity of the page by simply making the page appear longer or making the page appear too cluttered.

Just getting a user to register with a site is not enough, in order for the site to begin collecting data and serve the user, users must first login to the website. In order to prevent fraud, many websites require that users registering with them have valid e-mail addresses. One major problem was how could the site determine if a user has a valid e-mail address? The solution was to let the user select a username but not a password. Once the registration was complete, the password would be e-mailed to the address provided. If it is a valid e-mail address, the user will receive the password momentarily; if the password is not valid, the user will not receive the password and will thus not be able to use the site. These passwords that are e-mailed to users are created by a generator of some sort that typically creates some sort of pseudo-random password based on some registration keyword. The password that it creates needs to be difficult to guess, because a hacker that is able to access the account of a registered user may be able to steal credit card numbers or social security numbers. However, it is important that the user can enter this password without any problems so that they may begin using the site as soon as they want.

Therefore, a balance must be struck between a password that is suitably complex enough that is cannot easily be cracked by hackers, yet is easy enough for a user to remember at least long enough for them to enter into the login for the first time (users are typically allowed to change their passwords after successfully logging in for the first time). If the password generator created only simple passwords such as "cat" or "dog", they would be far too easy to figure out. There are hacking programs out now that would be able to deduce such simple passwords in a matter of moments. Since not all users change their passwords after login, this option is simply not viable as a security measure. A complex password such as "qwrty12415" would be much more difficult to guess but may also be too difficult for a user to remember or type. It is generally accepted that the more complex a password becomes, the more difficult it is to figure out, and thus the password is more secure. Many websites offer security guidelines when choosing (or designing) your password. The sites typically try to encourage users to mix lowercase, uppercase, numeric, and non-alphabetic characters into a password in order to make the password more difficult to decipher². However, trying to implement these rules in a computer-generated password usually results in some completely random password that is almost impossible for users to remember. It also creates problems with character recognition.

The halfway point between these two extremes may be a password that consists of a simple word and a short number. With a password of this type, such as "cat34", the password would be easy to remember, easy to type, but much more difficult to guess than just the password without the number. This password obviously would not stand the test of time as it is still relatively simple and could eventually be deciphered by unethical users, but as a temporary measure, it provides much better security while reducing the frustration level of users who are trying to login to the site.

Such a password also helps with another problem that is often encountered in randomly generated passwords. In certain fonts, it can be very difficult to tell the difference between certain characters. For example, what are the characters in the following passwords – "dPe20Rl", "WOr1d2"? It is very easy to mistake the zero in the first password for a capital "oh" and the numeral one in the second password for a lowercase "ell". Misinterpreting characters can be a source of incredible frustration for users who are attempting to login to a site, especially casual users who might not be able to figure out exactly what the problem is. If the hassle is too great, perhaps they will not even bother trying to fix the problem in order to use the site. Or they might think there is a problem with the web site.

By using the password that is a combination of the simple word and number, the chances of a mistaken character are significantly reduced. Rather than the possibility of this occurring anywhere in the password, as is the case in the completely random password, the only place it could possibly happen in this password at the point where the word ends and the numeral begins. Even then, it would have to be such a password that the prefix simple word could be a word with or without the character in question e.g. fur"l". Furthermore, if such a specific problem were to occur, it would be much easier for users to recognize that they might be reading it incorrectly since they have some sort of general knowledge about the inclusion of alphabetic characters and numerals, and the relative locations of each. Thus, the number of errors that would result from misinterpreted characters has decreased significantly when using this hybrid password, while still retaining much of the security of the truly random password.

These innovations can be applied to other areas of computing as well, although not in the exact same way. Software registration (i.e. converting from shareware to the full version) often requires a username and a registration code, which is very similar to typical usernames and passwords in that the user provides the username and the password is then generated by the software manufacturers. Difficulties in legibility in a case such as this would be even more disastrous that the web registration errors above because in these cases users have typically paid some sort of registration fee in order to use the software. If the software registration does not work, users will be even more frustrated than if a website registration failed. Unfortunately, in such cases, it is not viable for the company to create a password scheme as described above.

Typically, software registration involves some sort of algorithm to determine, if the registration code is correct, which allows for extraordinarily complex codes with little software coding implementing it correctly. Software registration codes are typically more complex than login passwords because the registration algorithm cannot be changed every few days like a login password can. In this case, it would probably be feasible to design a registration code generator that simply won’t produce a code that contains possibly conflicting characters. This would cause a negligible decrease in the pool of possible registration codes while eliminating the problem of misinterpreted characters.

This is also a possible solution for the web login process, and if used in conjunction with the hybrid password mentioned earlier, could reduce errors even further. The experiment will determine if there is a statistically significant difference in the number of errors users experience with the various password generation techniques and what their subjective impressions are of the techniques.

Department of Computer Science: Direct questions and comments to the student editorial team