7
$\begingroup$

I'm doing a study on why it is difficult to remember passwords. I would imagine that it would be easier for people to remember a password like "strawberryhouse" than "$tr@wb3rr!", even though the former has more characters.

Is there any research that backs up that idea?

|improve this question
$\endgroup$
9
$\begingroup$

One basic explanation would be a chunking one -- that it's easier to combine several words into a single memory unit than letters and numbers. In 2000, Alan Baddeley proposed the episodic buffer as an important component of the working memory (WM) system. According to Baddeley, the episodic buffer imbues WM with the ability to join information together, even when that information is of different modalities (e.g., sight and sound). Even though "$tr@wb3rr!" may be as memorable as the word "strawberry," with enough practice "strawberryhouse" can be just as facile (and a stronger password to boot).

Another concern is that while you'll likely always remember "strawberryhouse," only remembering the gist of the alphanumeric password ("I remember it sounds like 'strawberry'") can lead to verbatim errors of recall ("Was it '$tr@wb3rr!,' '$tr@wb3rri,' or "$tr@wb3rry?'"). I can find some empirical support on this track if it's useful, too.

Baddeley, A. (2000). The episodic buffer: a new component of working memory? Trends in Cognitive Science, 4, 417-423.

|improve this answer
$\endgroup$
  • $\begingroup$ This answer is mostly right, but it doesn't adequately emphasize the importance of semantic meaning in the chunking for memory. Strawberryhouse is one or two meaningful words, "$tr@wb3rr!" is the word plus the changes which need to be registered and remembered separately. $\endgroup$ – William B Swift Feb 15 '12 at 0:56
4
$\begingroup$

I believe this phenomenon is best viewed through the lens of the interactive activation model for word recognition (McClelland & Rumelhart, 1981), which was put forth to explain a similar phenomenon, namely the ability to more easily recognize letters within a word as opposed to to letters not comprising a word.

As the image below illustrates, this ease of recognition comes from the top down influence of the known word concepts on the possible identities of the letters.

enter image description here

Now, to tie this back into your original question, we can view the task of remembering a password as one of converting a stored concept into a character string (i.e. something like the interactive activation model without the bottom up line component). If your concept is "strawberry", then there's a strong top down influence to choose 's' as the first character of the password, since that's the most common first character of "strawberry". Now many have formed associations between 's' and '$', so perhaps the latter might get some response, but not nearly to the extent of the actual letter, since letters are far more commonly used within words than symbols are.

McClelland, J.L., & Rumelhart, D.E. (1981). An interactive model of context effects in letter perception: I. An acccount of basic findings. Psychological Review, 88, 375-407.

|improve this answer
$\endgroup$
  • $\begingroup$ .... 107 is the minimum size of X for which your last statement is true, is that a reasonable value? Increasing the exponent always has a much more drastic effect than increasing the base, so the rule in your quote is an awful rule-of-thumb. $\endgroup$ – Artem Kaznatcheev Feb 15 '12 at 0:04
  • $\begingroup$ eh, standard ASCII is 256, so not to unreasonable. Either way, that last bit was just a supplement; a nod to other possible answers to this question. The IAC part is my proper answer. Should I delete the tangential parts of my answer? $\endgroup$ – zergylord Feb 15 '12 at 0:16
  • $\begingroup$ @zergylord it's pretty unreasonable. my keyboard doesn't have anywhere close to 107 non-alpha characters, and it's quite unreasonable to think many people use charmap to type in their passwords. I would delete it, yes. $\endgroup$ – Jeff Feb 15 '12 at 0:25
  • $\begingroup$ edited out that adhoc equation. Kept the point that increasing the character set increases the total problem space, but deleted any indication of it being the whole solution to this problem. $\endgroup$ – zergylord Feb 15 '12 at 0:31
  • $\begingroup$ the whole point of my comment, and of the XKCD comic, is that increasing the length of the password has a much more drastic effect than increasing the character set. So even the general comment is questionable. If you stuck to just the model as a partial answer without the extra comments, I would upvote. $\endgroup$ – Artem Kaznatcheev Feb 15 '12 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.