The Problem with Passwords

Overview

User authentication doesn’t scale well. The more accounts we create, the more passwords we need to remember. In a recent report released by LastPass, nearly half of respondents said they had between one and ten online accounts. Yet research revealed that the average person using a password manager keeps track of almost 200 passwords. It's no wonder then that the top five passwords for 2018 were: 123456, password, 123456789, 12345678, and 12345.

Due to the large number of accounts that require passwords, users employ a variety of methods to handle that complexity. Whether people reuse simple passwords, write passwords in a book, or store random passwords in a password manager — each method has its benefits and drawbacks. Often which strategy someone uses is based on their motivations and beliefs regarding access and security.

Sources: LastPass - The Psychology of Passwords and Duo Labs - State of the Auth

It’s not only the number of accounts in combination with a user’s beliefs that can cause problems, there is also a fundamental tension between convenience and security. If we design our products for too much convenience, we risk compromising our users' security. However, if we make security a burden for the user, we risk losing user sign ups and engagement or even prevent existing users from accessing our products.

Process

For this project I decided to follow the Design Thinking methodology. This method ensures that I am basing all of my concepts and design decisions on the needs of real users.

Empathise

Everyone who uses the internet will have created many accounts, whether for personal or professional use. In an effort to understand the current attitudes and practices in managing online accounts and security, I read a few studies and research papers on this topic. I also conducted some in-person user interviews to gain insight into their behaviours and beliefs regarding the protection of their identity and information online. From these interviews I created three proto-personas in order to better understand the expectations, concerns, and motivations of different types of users.

I also analysed the typical user flows for each of my proto-personas when they are signing into their accounts, so I could more fully understand the different experiences people have depending on how they choose to manage their online profiles and security.

Define

The next phase of my analysis was to define the problems. After synthesising my understanding from my research, I decided to focus on two problems: convenience vs. security and two-factor authentication. From my user research, these two areas stood out as has having the greatest amount of variability in behaviours and beliefs. Therefore, they seemed like good areas to investigate further.

I then used the Jobs To Be Done framework — which includes creating Job Stories with a situation, a motivation, and an expected outcome — to expand on my proto-personas and explore their different wants and needs.

• When the Convenience User goes online, they want to quickly and easily access their accounts, so they can always stay connected.
• When the Moderate User goes online, they want to easily, but securely access their accounts, so they can feel safe while online.
• When the Security User goes online, they want to securely access their accounts using multiple factors, so they know that their information and transactions are protected.

From my research, user interviews, and job stories I then created two How Might We questions:

1. How might we design account sign up experiences that allow users to quickly create an account while encouraging them to follow better security guidelines?
2. How might we implement two-factor authentication solutions that are easy to set up, convenient to use, and always accessible?

Ideate

By sketching out solutions on paper, I could quickly and easily concept different ideas. My main objective was to create a signup form that would allow users quickly create an account while guiding them in making a strong password.

Wireframe concept for signup form.

Prototype

I created a prototype for my account sign up experience which incorporates my learnings from user research and the recommendations for strong passwords suggested by security experts.

Proposed solution:

1. Require strong passwords
   • At least 8 characters long, using both upper case and lower case characters, numbers, and symbols OR at least 15 characters long with any combination of characters
   • Always show the minimum requirements and check off when met
   • The minimum requirements would ensure users are creating more secure passwords. Having two different sets of requirements would allow the user to either create a shorter, more complex password or use a long passphrase. These requirements would create at least two quadrillion different combinations.
2. Show the user what a secure password looks like by including a popup with a suggested password when the password input is in focus
3. Don't require a password confirmation step and allow the user to unmask their password during signup
   • Letting the user see their unmasked password during sign up helps with password memorisation and correcting any mistakes
   • Hiding the password and require a confirmation tends to encourage users to create simple passwords that are easily remembered and typed without mistakes
4. Show appropriate and clearly defined inline validation messages
   • Error information would be shown below the input field and encourages the user to take immediate action
   • Form validation should be immediate and clearly communicated using colour and copy
5. The sign up submission button is disabled until the form has been filled out without errors and the password has passed the minimum requirements

I also protoyped a user flow for setting up and using an authenicator app for 2FA. I decided to create a user flow because 2FA requires using multiple services, rather than just several screens on only one website or app. My main objective was to create a common method of using 2FA that could be used for any account, on any device, anywhere in the world.

Proposed solution:

1. Enabling and setting up 2FA would be part of the onboarding experience, after the user has created an account and verified their email address or phone number
2. Include many different types of 2FA including email, phone, authenticator apps, or tokens
   • The user would have the flexibility to choose the solution that best suits them
   • Streamline and simplify the process of enabling and using 2FA to encourage uptake
   • The user could use one common method of 2FA for all of their accounts rather than recieving SMS codes from one service, emails from another, and authenticator app codes for a third
3. 2FA should be available offline and accessible anywhere in the world
   • We don't want our users to run into geographic or physical restrictions. For instance, if the only option was to receive 2FA codes via SMS, a user might have an issue signing into their account or completing a transaction if they have a new phone number, are travelling, or have moved to a foreign country.