"Passwords protect my stuff"-a study of children's password practices

Area of Science:

• Cybersecurity and Human-Computer Interaction
• Child Development and Technology Use
• Information Security Education

Background:

• Children's early and frequent technology use necessitates understanding their cybersecurity practices.
• Limited research exists on children's password behaviors, despite youth influencing future cyber culture.
• Investigating children's password knowledge is crucial for developing effective security education.

Purpose of the Study:

• To explore children's practices, perceptions, and knowledge concerning password creation and usage.
• To identify developmental factors influencing children's ability to generate strong passwords.
• To inform cybersecurity education strategies tailored for young users.

Main Methods:

• Surveys administered to 189 students in grades 3-8 from two Midwestern US schools.
• Data collected on password ownership, sharing habits, password length, and perceived security.
• Analysis of password creation practices in relation to cognitive and linguistic development.

Main Results:

• Children use an average of 2 passwords for school and 3-4 for home, keeping them private.
• Password length averaged 7 characters (grades 3-5) and 10 characters (grades 6-8).
• Only 13% created strong passwords, indicating a gap in sophisticated password generation skills.

Conclusions:

• Children possess appropriate mental models of password functions and exhibit generally good security practices.
• Cognitive and linguistic immaturity limits children's ability to create strong, complex passwords.
• Cybersecurity education must reinforce positive practices and introduce age-appropriate security skills.