Passwords are necessary for security and managing our online accounts ranging from emails to our social media profiles. To reduce the risk of cyberattacks, it is important that there be training and education for strengthening passwords and protecting our accounts.
While children may seem more technologically inclined because they have grown up in the digital era, they still face similar cybersecurity threats as the adults. In order to understand what kids know about passwords and their attitude in creating and using them, researchers at the National Institute of Standards and Technology (NIST) carried out a study surveying kids from 3rd to 12th grade.
The study discovered that children are learning practices like memorizing their passwords, but there is a gap between their understanding of good password practice and their behaviour. The NIST researchers presented their findings at a virtual cybersecurity conference called USENIX Security Symposium 2021.
According to data from the Pew Research Center, over one-third of parents with a child younger than 12 say their child began making use of a smartphone at the age of 5, and 67% of parents claim their child uses a tablet computer.
‘Younger children rely on parents a lot. Their first passwords were either given to them at school or by a parent to open their phone or tablet. So, what kind of guidance can we provide?’, said NIST researcher Yee-Yin Choong.
The researchers conducted the survey on over 1,500 children from ages 8-18 who are students of schools in the South, Midwest and Eastern regions of the U.S. Teachers carried out two versions of the survey, one for 3rd to 5th graders and the other for 6th to 12th graders. The surveys had the same questions but with age-appropriate language for each group.
On the bright side, the results from the study show that children are learning best practices on passwords like keeping their password private, avoiding writing the password on paper and logging out after online sessions. They reported that on the average, kids have two passwords for schools and between two to four for home.
The kids created passwords reflecting the current state of their lives, some of them referencing video games, animals, sports, movies etc. Examples included ‘yellow’, ‘doggysafesecure’ and ‘PrincessFrog248’.
Password strength was greater for elementary to high school students. Some of their stronger passwords included ‘dancingdinosaursavrwhoop164’ and ‘Aiken_bacon@28’.
Although the children were learning best practices, they also demonstrated bad password habits. They reused passwords, something which increased in frequency from elementary to high school students. They also often shared the passwords with their friends. ‘For adolescents, an important part of building friendships is building trust, which is shown with sharing secrets. Their perspective is that sharing passwords is not risky behaviour’, said Choong.
The study also made clearer what children thought about passwords. The survey asked, ‘Why do people need passwords?’ Answers varied among younger and older kids. Elementary students stated that safety was the principal reason while middle and high school students stated privacy.
Another interesting finding was that younger children depended on family support for creating and maintaining their passwords at home. This implies that families play an important role in establishing best practices in the home and parents influence their kids’ behaviour with passwords.
According to Choong, not a lot of studies have been done on kids and cybersecurity, which is why this work is important in aiding researchers understand more about the password use of children.
‘This was a very carefully designed study. We had to think carefully about the methodology’, said Choong. The researchers requested permission from the principal of each school before carrying out the study. They collaborated with the teachers in acquiring parental contest and administering the surveys.
In future studies, the NIST researchers will investigate children and parents’ understanding of privacy, online security and risky behaviours.
‘The end goal of this research is to better support children and provide recommendations that can be used to provide guidance to them, parents and educators. Overall, the focus is on providing guidelines and best practices so that they can stay safe and secure online while enjoying the benefits of the internet’, said Choong.
By Marvellous Iwendi.
Source: NIST