The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene Padmasree Gade Software Engineering Introduction Passwords continue to be one of the most common forms of user authentication. However, despite the significant advancements in password management tools and increased awareness of best practices, weak passwords and credential reuse remain prevalent vulnerabilities in cybersecurity. Research shows that these insecure behaviors—such as using easily guessable passwords or reusing credentials across multiple platforms—are key contributors to successful cyberattacks, including credential stuffing and brute-force attacks [1][5][7]. This paradox, where users are aware of the risks but still choose weak passwords, raises important questions about the psychological and practical barriers that prevent strong password adoption. Cognitive biases, such as the tendency to prioritize convenience over security and the perceived difficulty of managing numerous strong passwords, lead many users to resort to insecure practices [2][13]. Even when equipped with tools like password managers, users exhibit inconsistent adoption patterns, complicating the situation further [3][15]. Prior research has highlighted various reasons for weak password choices, including cognitive load (the mental effort required to remember multiple strong passwords) and convenience biases (the preference for simplicity over security) [14]. Users often opt for less secure passwords because they perceive it as easier or faster to use familiar, simple passwords across different accounts [13]. These patterns are not only influenced by individual decisions but are also shaped by the broader design of password management systems, which often fail to align with users’ cognitive abilities and security needs [14][3]. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 2 In this paper, we examine the complex interplay between psychological, technological, and behavioral factors that influence password-related decisions. Drawing on prior research, we introduce a causal loop diagram that illustrates the cyclical nature of weak password usage. This diagram reveals how user behavior, cognitive load, and the tools available to users (e.g., password managers) interact to perpetuate weak password practices. We argue that the solution lies in designing user-centric systems that take these psychological factors into account, ultimately helping users make more secure password choices. Related Work The challenge of balancing password security and user convenience has been a longstanding issue in cybersecurity research. Numerous studies have investigated the factors contributing to poor password hygiene and explored solutions to mitigate associated risks. Let us now review the key insights from existing literature, focusing on password generation, password managers, and user behavior. 1. Weak Password Usage and Reuse Weak passwords often arise due to user tendencies such as choosing memorable phrases, personal identifiers, or simple patterns. Umejiaku et al. highlighted the "human factor problem," where users prioritize convenience over security, leading to the reuse of passwords and insecure storage practices. These behaviors, while reducing cognitive load, increase vulnerability to attacks such as credential stuffing and dictionary-based guessing[1][7][8]. 2. Password Managers: Potential and Limitations The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 3 Password managers have been proposed as a solution to the growing demand for strong and unique passwords[3][15]. Studies show that password managers can improve security hygiene, with features like autofill and synchronization across devices enhancing usability[11][16]. However, they are not without flaws. A weak master password or a breach on the service provider's side could compromise the entire vault of stored credentials[9]. Additionally, as noted by Alkaldi and Renaud, mistrust and usability concerns deter widespread adoption, with 31% of users unlikely to use such tools even in the future[3]. 3. Password Generation Techniques Advancements in password generation strategies aim to strike a balance between security and usability. Umejiaku et al. proposed leveraging AI models, such as ChatGPT, to create strong and memorable passwords[1]. However, these models also introduce risks, as they can predict passwords based on minimal data, potentially aiding attackers[14]. Enhancements like mnemonic- based modifications and semantic transformations have been explored to strengthen passwords while improving memorability[16][2]. 4. Human-Centric Password Policies Human-computer interaction (HCI) research has emphasized the importance of designing password systems that align with user behavior[2][4]. Studies by Yıldırım and Mackie recommend focusing on usability by encouraging passphrase adoption and reducing complexity requirements[6][7]. The National Institute of Standards and Technology (NIST) has similarly revised guidelines, dropping frequent password changes in favor of length-based policies[10]. 5. Psychological Factors in Password Decision-Making The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 4 Behavioral psychology provides valuable insights into why users knowingly choose weak passwords[13]. Factors such as perceived effort, fear of forgetting, and skepticism toward new tools like password managers contribute to suboptimal practices[3][8]. Research highlights the need for educational interventions that address these psychological barriers, encouraging stronger password habits[11]. System Dynamics and Causal Loop Diagrams System dynamics is a methodology used to understand and model complex systems by analyzing their feedback loops. It helps identify how different elements within a system influence one another over time. A Causal Loop Diagram (CLD) represents these interactions using nodes (variables), directional arrows (causal relationships), and polarities (+/-) indicating whether a change in one variable reinforces (+) or counteracts (-) another. Unlike Stock and Flow Diagrams, which focus on quantifiable accumulations and rates of change, CLDs are better suited for conceptualizing behavioral and psychological dynamics. For this study, a CLD was chosen because it effectively captures the reinforcing behaviors and feedback mechanisms influencing password choices. The CLD in this paper represents psychological, cognitive, and technological factors contributing to poor password hygiene, demonstrating how different influences interact over time. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 5 Methodology I employed a system dynamics model to analyze the cyclic nature of weak password behaviors. The causal loop diagram (CLD)[] served as the primary tool for visualizing these dynamics. Each loop in the diagram represents a psychological or behavioral factor influencing password choices. System Dynamics Model - Causal Loop Diagram: The causal loop diagram illustrates five major feedback loops influencing password security: • Cognitive Load Loop (+): The mental effort required to remember complex passwords often leads users to favor simpler, insecure ones. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 6 • Trust and Skepticism Loop (-): Mistrust of password management tools discourages adoption, reinforcing manual password practices. • Convenience Loop (+): Users prioritize easy-to-remember passwords over security due to perceived effort. • Manual Password Management Loop (+): Inefficient strategies, such as writing down passwords, increase security risks. • Risk Awareness and Behavior Change Loop (-): Although awareness of risks can encourage behavior change, convenience often overrides security considerations. Each loop highlights key factors influencing password-related decisions. The direction and polarity of each arrow show how changes in one factor affect others, reinforcing (or counteracting) security behaviors. Understanding these interactions allows for targeted interventions to disrupt negative feedback cycles and promote better password hygiene. Findings and Implications 1. Persistent Weaknesses in Password Practices Users continue to engage in weak password behaviors despite awareness of risks. This contradiction stems from cognitive biases and usability concerns surrounding password security measures. 2. Addressing Trust and Usability with Customization A personalized password management approach can increase adoption: • User-Driven Password Generation: A questionnaire-based tool can generate strong, memorable passphrases based on user preferences and cognitive strengths. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 7 • Psychological Alignment: Aligning with memory techniques (mnemonics, semantic transformations) can improve usability and security. • Reducing Perceived Effort: Automating password creation and aligning suggestions with user behaviors can minimize friction in adoption. 3. Disrupting Reinforcing Loops • Building Trust in Tools: Personalization can increase confidence in password managers. • Countering Predictive Attacks: AI-driven password generation can resist brute force and dictionary attacks. • Encouraging Length-Based Security: Adopting NIST-compliant policies that emphasize passphrase length over complexity can enhance security without burdening users. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 8 1. Cognitive Load Loop: The mental effort required to remember complex passwords often leads users to choose simpler ones. Users struggle to balance security and memorability, often resorting to insecure practices. The reinforcing loop (R1) suggests that cognitive effort discourages strong password selection, making it a self-reinforcing cycle. Solutions involve improving usability and reducing perceived difficulty. • Weak password selection: Leads to security breaches, increasing awareness of risks. • Awareness of risks: Enhances motivation to improve, leading to the adoption of strong passwords. • Cognitive load of coming up with strong passwords: Increases the perceived effort of difficulty remembering and frustration, reinforcing weak password selection. • Adoption of strong passwords: Can be influenced by customized, easy-to-use password management tools to reduce cognitive load. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 9 2. Trust and Skepticism Loop: Mistrust of password management tools, whether due to perceived vulnerabilities or usability concerns, discourages their adoption. Many users view password managers as a single point of failure, undermining trust and adoption. This balancing loop suggests that increasing trust through better usability and security awareness can gradually reduce skepticism, leading to a more secure password ecosystem. • As trust in password management tools increases, users are more likely to adopt strong passwords. • However, skepticism to use password management tools counteracts this, preventing full adoption. • The system seeks equilibrium between skepticism and trust, preventing extreme outcomes. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 10 3. Convenience Loop: Users frequently prioritize convenience over security, opting for easy-to- remember passwords that can be reused. The perceived effort of creating and managing strong passwords drives reliance on simpler, less secure options. This balancing loop demonstrates how improving convenience can positively influence password security. • Weak password selection leads to security breaches. • Security breaches increase awareness of risks, motivating users to adopt stronger passwords. • Adoption of strong passwords is supported by improved convenience via tools that simplify password management. • Enhanced convenience reinforces stronger password habits, improving security over time. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 11 4. Manual Password Management Loop: Reliance on manual strategies increases cognitive strain and perpetuates weak habits. Inefficient strategies like using paper notes or reusing passwords exacerbate cognitive strain. This balancing loop highlights the challenge users face when manually managing complex passwords, often reverting to unsafe practices. • Awareness of risks drives motivation to improve password security. • Users attempt manual password management, which often leads to the fear of forgetting due to password complexity or multiple accounts. • This fear encourages password reuse, weakening security. • Resulting security breaches increase awareness of risks, reinforcing the cycle. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 12 5. Risk Awareness and Behavior Change Loop: While awareness of risks can encourage behavior change, its impact is often insufficient to override convenience-driven habits. While users recognize the risks of weak passwords, convenience often takes precedence. This balancing loop emphasizes the role of awareness and motivation in fostering positive behavioral changes. • Weak password selection leads to security breaches. • Security breaches raise awareness of risks, encouraging users to improve password habits. • Increased awareness drives motivation to improve, prompting the adoption of strong passwords. • This improved behavior reduces the frequency of weak password selection and security breaches, gradually stabilizing password security. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 13 Findings To address the impact of the above factors influencing bad password practices we can use a password management tool that leverages user inputs via a questionnaire to generate strong, memorable passwords or passphrases. The findings integrate insights from existing literature to contextualize the proposed tool’s potential in disrupting the reinforcing cycles of poor password hygiene. 1. Persistent Weaknesses in Password Practices Weak password behaviors—such as reusing credentials, choosing simple patterns, or storing passwords insecurely—persist despite widespread awareness of their risks. Research highlights how cognitive biases and the burden of remembering multiple passwords drive users to prioritize convenience over security. Even with tools like password managers, mistrust and perceived usability barriers contribute to inconsistent adoption. 2. Psychological Barriers and Behavioral Loops A key barrier to stronger password practices is the effort required to balance memorability with complexity. As noted by Umejiaku et al., users often resort to insecure coping strategies due to the cognitive strain of managing multiple accounts. These behaviors create reinforcing loops where poor practices undermine trust in security outcomes, perpetuating weak habits. 3. Addressing Trust and Usability with Customization The proposed password management tool directly addresses user skepticism and usability concerns by leveraging a customized approach: The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 14 • Personalized Questionnaire: Users answer questions about their preferences, behaviors, and memory strengths. • Tailored Suggestions: Based on responses, the tool generates strong and easy-to- remember passwords or passphrases. Techniques may include mnemonic-based modifications, semantic transformations, or length-based adjustments, as suggested in previous research. • Psychological Alignment: By considering user-specific factors, the tool reduces cognitive load and increases trust, enhancing adoption and security outcomes. 4. Disrupting Reinforcing Loops The innovation disrupts key reinforcing cycles of poor password hygiene: • Reducing Perceived Effort: By automating password generation and aligning outputs with user preferences, the tool minimizes the effort required to adopt stronger practices. • Building Trust in Tools: Customization fosters user confidence in the tool’s relevance and security, addressing mistrust highlighted by studies like Alkaldi and Renaud. • Improving Memorability: Tailored passphrases align with psychological principles of repetition and association, making secure practices easier to sustain. 5. Addressing Broader Security Challenges In addition to disrupting insecure behavioral cycles, the tool mitigates specific security risks: • Countering Predictive Attacks: By generating unique passwords not derived from predictable patterns, the tool resists brute force and dictionary attacks. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 15 • Encouraging Length-Based Security: Building on NIST guidelines, the tool emphasizes passphrase length over complexity, aligning with findings by Yıldırım and Mackie. 6. Implications for Design and Policy The proposed solution has significant implications for cybersecurity practices: • User-Centric Design: By integrating behavioral and psychological insights, the tool prioritizes usability without compromising security. • Scalability: The tool can be extended to organizations, tailoring password policies to diverse user bases while maintaining compliance with best practices. • Future Research: Studies should evaluate the tool’s effectiveness in real-world scenarios, focusing on adoption rates, usability feedback, and measurable improvements in password security. Conclusion The persistence of weak and reused passwords underscores the need for innovative solutions that address the psychological and practical barriers to strong password adoption. Our proposed password management tool, by aligning with user preferences and cognitive strengths, offers a promising approach to enhance security without compromising usability. By fostering a more user- friendly and psychologically aligned approach to password management, this tool can play a pivotal role in enhancing cybersecurity while improving the user experience. Future work will focus on real-world implementation and evaluation of the tool, exploring its effectiveness in reducing cybersecurity risks while enhancing user experience. The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 16 References [1] A. P. Umejiaku, P. Dhakal, and V. S. Sheng, "Balancing Password Security and User Convenience: Exploring the Potential of Prompt Models for Password Generation," Electronics, vol. 12, no. 10, pp. 2159, May 2023. doi: 10.3390/electronics12102159. [2] F. Yıldırım and I. Mackie, "Encouraging users to improve password security and memorability," International Journal of Information Security, vol. 18, pp. 741-759, 2019. doi: 10.1007/s10207-019-00429-y. [3] A. Alkaldi, K. Renaud, and L. Mackenzie, "Encouraging Password Manager Adoption by Meeting Adopter Self-Determination Needs," in Proc. 52nd Hawaii International Conference on System Sciences (HICSS), Maui, HI, USA, 8–11 Jan. 2019, pp. 4824–4833. doi: 10.1109/HICSS.2019.00594. [4] A. G. Forget, "A World with Many Authentication Schemes," Ph.D. Thesis, Carleton University, Ottawa, ON, Canada, 2012. [Online]. Available: https://doi.org/10.5555/984720.984724. [5] D. Florêncio and C. Herley, "Where do security policies come from?" in Proc. 6th Symposium on Usable Privacy and Security, Redmond, WA, USA, 14–16 Jul. 2010. doi: 10.1145/1837110.1837124. [6] R. Shay, S. Komanduri, A. L. Durity, et al., "Designing password policies for strength and usability," ACM Transactions on Information and System Security, vol. 18, no. 1, pp. 1-34, 2016. doi: 10.1145/2891411. https://doi.org/10.3390/electronics12102159 https://doi.org/10.1007/s10207-019-00429-y https://ieeexplore.ieee.org/document/8936178 https://doi.org/10.5555/984720.984724 https://dl.acm.org/doi/10.5555/1837110.1837124 https://dl.acm.org/doi/10.5555/2891411 The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 17 [7] W. Grawemeyer and H. Johnson, "Using and managing multiple passwords: A week to a view," Interact. Comput., vol. 23, pp. 256–267, 2011. doi: 10.1016/j.intcom.2011.03.007. [8] M. Komanduri, R. Shay, P. G. Kelley, et al., "Of passwords and people," in Proc. SIGCHI Conf. Human Factors in Computing Systems, Vancouver, BC, Canada, 7–12 May 2011, pp. 319– 328. doi: 10.1145/1978942.1979321. [9] B. Alhamed and S. Bhatia, "VowPass: Novel method to generate secure and memorable passwords," in Proc. 4th International Conference on Signal Processing and Information Security (ICSPIS), Virtually, 24-25 Nov. 2021, pp. 36-40. doi: 10.1109/ICSPIS53734.2021.9652188. [10] D. A. Murray and D. Malone, "Evaluating password advice," in Proc. 28th Irish Signals and Systems Conference (ISSC), Killarney, Ireland, 20–21 Jun. 2017, pp. 254-259. doi: 10.1109/issc.2017.7983609. [11] M. Grawemeyer and H. Johnson, "Using and managing multiple passwords: A week to a view," Interact. Comput., vol. 23, pp. 256–267, 2011. doi: 10.1016/j.intcom.2011.03.007. [12] W. Lee, K. Sjöberg, and A. Narayanan, "Password policies of most top websites fail to follow best practices," in Proc. 2022 ACM Conference on Computer and Communications Security (CCS ’22), Virtual Event, 24–28 Oct. 2022, pp. 1075-1090. doi: 10.1145/3485554.3487438. [13] Moustafa, Ahmed A., et al. “The role of user behaviour in improving cyber security management.” Frontiers in Psychology, vol. 12, 18 June 2021, 10.3389/fpsyg.2021.561011. [14] F. Z. Glory, A. Ul Aftab, O. Tremblay-Savard and N. Mohammed, "Strong Password Generation Based On User Inputs," 2019 IEEE 10th Annual Information Technology, Electronics https://doi.org/10.1016/j.intcom.2011.03.007 https://doi.org/10.1145/1978942.1979321 https://doi.org/10.1109/ICSPIS53734.2021.9652188 https://doi.org/10.1109/issc.2017.7983609 https://doi.org/10.1016/j.intcom.2011.03.007 https://doi.org/10.1145/3485554.3487438 https://doi.org/10.3389/fpsyg.2021.561011 The Psychology Behind Password Choices: A System Dynamics Approach to Enhancing Security Hygiene 18 and Mobile Communication Conference (IEMCON), Vancouver, BC, Canada, 2019, pp. 0416- 0423, doi: 10.1109/IEMCON.2019.8936178. [15] H. Padalia, H. Patel, A. Deshmukh, M. Patil, A. Kumar and N. Kumar Nrip, "A Study on Password Manager: Users' Perspective," 2023 International Conference on Computational Intelligence for Information, Security and Communication Applications (CIISCA), Bengaluru, India, 2023, pp. 72-75, doi: 10.1109/CIISCA59740.2023.00024. [16] M. Shahid and M. A. Qadeer, "Novel scheme for securing passwords," 2009 3rd IEEE International Conference on Digital Ecosystems and Technologies, Istanbul, Turkey, 2009, pp. 223-227, doi: 10.1109/DEST.2009.5276738. https://doi.org/10.1109/IEMCON.2019.8936178 https://doi.org/10.1109/CIISCA59740.2023.00024 https://doi.org/10.1109/DEST.2009.5276738