While measuring physiological responses is a common practice in the field of neuroscience, it is rare in the usability arena and in password usability studies, in particular. This is unfortunate, as the use of such implicit measures could complement more traditional, explicit metrics of performance... See full abstract

While measuring physiological responses is a common practice in the field of neuroscience, it is rare in the usability arena and in password usability studies, in particular. This is unfortunate, as the use of such implicit measures could complement more traditional, explicit metrics of performance like password entry times and errors. Capturing participants' electrodermal activity (i.e., skin conductance response [SCR]) and eye-movement patterns during password entry can provide unique insights about users' intentions, perceptions of difficulty, and emotional state that would otherwise be impossible to gain via behavioral and self-report measures. We expect SCR for more difficult passwords to be of greater amplitude and frequency than SCR for easier passwords, where password difficulty is a function of multiple password composition factors such as overall length and frequency of special symbols. Additionally, more difficult passwords should result in more repeat fixations, fixations that are more frequent and of longer duration than for easier passwords. Physiological measures may improve password difficulty classification accuracy of a naïve Bayesian classifier over and above behavioral measures of error rates and completion times. The potential to differentiate difficult from easy passwords based on SCR and fixation frequency and duration implies that we have indeed found a promising use for implicit indicators of stress, encoding, and retrieval processes associated with password learning and entry across devices. The current exploratory work demonstrates the potential practical value of combining physiological and behavioral measures in password usability research. This should be of interest to the usability, security, and neuroscience research communities, as it provides a novel measurement approach for the former and an interesting applied research problem for the latter.
Hide full abstract