Guidelines for ethical nudging in password authentication

Karen Renaud, Verena Zimmerman

Research output: Contribution to journalArticle

2 Citations (Scopus)
137 Downloads (Pure)

Abstract

Nudging has been adopted by many disciplines in the last decade in order to achieve behavioural change. Information security is no exception. A number of attempts have been made to nudge end-users towards stronger passwords. Here we report on our deployment of an enriched nudge displayed to participants on the system enrolment page, when a password has to be chosen. The enriched nudge was successful in that participants chose significantly longer and stronger passwords. One thing that struck us as we designed and tested this nudge was that we were unable to find any nudge-specific ethical guidelines to inform our experimentation in this context. This led us to reflect on the ethical implications of nudge testing, specifically in the password authentication context. We mined the nudge literature and derived a number of core principles of ethical nudging. We tailored these to the password authentication context, and then show how they can be applied by assessing the ethics of our own nudge. We conclude with a set of preliminary guidelines derived from our study to inform other researchers planning to deploy nudge-related techniques in this context.
Original languageEnglish
Pages (from-to)102-118
Number of pages17
JournalSAIEE African Research Journal
Volume109
Issue number2
Early online date21 Feb 2018
DOIs
Publication statusPublished - Jun 2018

Fingerprint Dive into the research topics of 'Guidelines for ethical nudging in password authentication'. Together they form a unique fingerprint.

Cite this