  User-chosen passwords remain essential to online security, and yet people
continue to choose weak, insecure passwords. In this work, we investigate
whether prospect theory, a behavioral model of how people evaluate risk, can
provide insights into how users choose passwords and whether it can motivate
new designs for password selection mechanisms that will nudge users to select
stronger passwords. We ran a user study with 762 participants, and we found
that an intervention guided by prospect theory -- which leverages the
reference-dependence effect by framing selecting weak passwords as a loss
relative to choosing a stronger password -- causes approximately 25% of users
to improve the strength of their password (significantly more than alternative
interventions) and reduced the final number of weak passwords by approximately
25%. We also evaluate the relation between user behavior and users' mental
models of hacking and password attacks. These results provide guidance for
designing and implementing account registration mechanisms that will
significantly improve the strength of user-selected passwords, thereby
leveraging insights from prospect theory to improve the security of systems
that use password-based authentication.
