  Text-based passwords continue to be the prime form of authentication to
computer systems. Today, they are increasingly created and used with mobile
text entry methods, such as touchscreens and mobile keyboards, in addition to
traditional physical keyboards. This raises a foundational question for usable
security: whether text entry methods affect password generation and password
security. This paper presents results from a between-group study with 63
participants, in which each group generated passwords for multiple virtual
accounts using a different text entry method. Participants were also asked to
recall their passwords afterwards. We applied analysis of structures and
probabilities, with standard and recent security metrics and also performed
cracking attacks on the collected data. The results show a significant effect
of text entry methods on passwords. In particular, one of the experimental
groups created passwords with significantly more lowercase letters per password
than the control group ($t(60) = 2.99, p = 0.004$). The choices for character
types in each group were also significantly different ($p=0.048, FET$). Our
cracking attacks consequently expose significantly different resistance across
groups ($p=0.031, FET$) and text entry method vulnerabilities. Our findings
contribute to the understanding of password security in the context of usable
interfaces.
