Workshop on Security Fatigue

In this paper we explore the differential perceptions of cybersecurity professionals and general users regarding access rules and passwords. We conducted a preliminary survey involving 28 participants: 15 cybersecurity professionals and 13 general users. We present our preliminary findings and explain how such survey data might be used to improve security in practice. We focus on user fatigue with access rules and passwords.

Many people feel overwhelmed by the number of Web accounts they need to access on a regular basis, because of the quantity of passwords that have to be updated, especially in the context of many frequent password change mandates. This sense of challenge has been referred to as Password Fatigue and is essentially defined as simply having too many passwords to remember (or deal with) on an erratic schedule and/or inconsistent basis.

People who suffer password fatigue are simply too exhausted from all the passwords they have to remember and all the work it takes to keep them up to date. Although there exist shortcuts and some handy tools for automating this process, at the end of day, it all comes down to people's own time and attention. Both of which are in short supply.