Rethinking user password management

Bryan Christ
Additional contact information
Bryan Christ: Chief Information Officer and Chief Technology Officer, Bravura Security, USA

Cyber Security: A Peer-Reviewed Journal, 2025, vol. 9, issue 1, 18-26

Abstract: This paper critically examines the continued reliance on passwords despite its flaws. It explores how the inherent cognitive limitations of users — exemplified by Miller’s Law and the challenges of short-term memory — contribute to insecure practices such as password reuse and reliance on easily remembered, yet predictable, password structures. The paper reviews historical and contemporary research on user behaviour in password creation, highlighting how increasing complexity requirements often lead users to adopt counterproductive shortcuts and coping mechanisms. In addition to dissecting the cognitive challenges, the paper evaluates current security practices including multi-factor authentication (MFA) and highlights some prominent weaknesses. The paper proposes abandoning current password practices, which are user-centric, and adopting a new paradigm. In this model, principles are drawn from solutions in the privilege access management (PAM) and password manager realms to craft an architecture that balances security and convenience while eliminating cognitive burden. Readers will take away a comprehensive understanding of the limitations of traditional password systems, insights into modern authentication methods, and a roadmap for adopting more user-friendly and robust security practices that shift the responsibility of password complexity away from the end user. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.

Keywords: password management; password fatigue; password hygiene; forgetting passwords; password rotation; password complexity (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/9642/download/ (application/pdf)
https://hstalks.com/article/9642/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2025:v:9:i:1:p:18-26

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().