How do I convince others of the importance of password management?

Question

I just got married, and my wife and I are in the midst of combining finances, etc.

We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character password with LastPass.

No, don't do that! How can I access it if you use LastPass? Just make it something simple to remember!

We compromised on that one - I generated a password that we both agreed on that's reasonably long with a mix of characters, and yet it's something that she can remember off the top of her head. (Never mind that with LastPass you can share passwords to various accounts, without either person actually even knowing the password!)

My wife definitely fits into the "average user" category as opposed to the "power user" category. I've been able to convince her to turn on two-factor auth whenever possible, but for the most part she is unwilling to trade convenience for security.

Obviously, it doesn't need to be this way. I use LastPass religiously, and she sees me use it regularly to generate and use passwords. I'm in her ear fairly regularly about the importance of password security (see various institutions getting hacked - which I don't really believe were anything sophisticated, just poor IT infrastructure because of management thinking IT is not "value-added"), etc. She (and a lot of my other friends) are quite content with having the standard 4 passwords for all their websites. They don't really see what the point is of having more difficult passwords. For my wife, it's "I'll set up LastPass some other time, it's not really that important anyway." I think everyone on this SE would think that it truly is that important.

I really don't understand what the hang-up is with using a password manager, but then again it's so obvious to me why nobody should leave home without one. How can we computer-savvy folks educate/convince/etc the non-computer-savvy ones we care about to take their own security seriously?

Answer 1

Your wife is not using LastPass because she has better things to do, not because she's incapable of realising its utility.

You would think that once people properly understand the risks they're exposed to (which requires a serious amount of education), they would automatically start to comply with whatever security advice is thrown their way. Well, this assumption has been proven wrong multiple times. See Herley's 'So long and no thanks for the externalities', which has a couple of examples of wasteful security, and Beautement and Sasse's 'Compliance Budget' for a general theory of how humans behave with regard to security.

In economics of information security, there are several examples of people willingly taking risks because it saves time they need for other tasks, or because they perceive potentially negative side-effects to complying (such as being locked out, or embarrassed in front of someone else).

Hence, rather than insisting on your wife doing what you think is good for her, identify her needs, her priorities, her worries and her actual problems. Then, deploy a tool that does work for her (if there's any) and work with her to make sure she knows how to use it and perceives its utility and limitations properly.

For instance, I don't use password managers because I use some of my accounts on so many devices that I have to know the passwords, because I have some passwords that have to comply to such silly policies and be changed every other day (and I hate having to resync my passwords on each device), I don't trust online password stores the least in the world, and because some of my devices are targeted often enough that I don't want them storing many passwords. Most of these problems I have are probably addressable one way or another, but I don't want to lose a day of work setting up processes that go against my habits. And yet, I'm a security engineer. In conclusion, most users will prefer appropriateness and value to security in most decision-making situations.

Answer 2

Like many of the above I also recommend the use of stories and fear!

In particular you need to explain WHY its so bad to have the same password across different websites, as perhaps she doesn't understand the problem with this. I find this is often the case with those outside of the IT industry. They see it as just a best practice suggestion and maybe even paranoid.

You need to remind her about all the recent password leaks, which I'm sure she has heard about, ideally taking the example of a service she might actually have used. You explain that this means there might be databases on the dark web with her passwords from say LinkedIn, Yahoo, Marriott etc. If she uses the same password for banking, amazon, pizza delivery, uber etc. then a hacker can log onto those websites trying the password they stole from elsewhere and order services fraudulently on her account.

A really good way to demonstrate this is to check her email or even her passwords on https://haveibeenpwned.com/ I find that is really effective in convincing people!

Answer 3

Your problem is more a question of awareness and practice. The fact that as security specialists, we take our job very seriously (which is the right thing) and "expect" others to take security seriously as well. Since you are more closer to the world of the "bad cyberspace", you are well aware of the controls that need to be kept in place to prevent them. Your better half on the other hand isn't that aware of the effects that bad security practices have. I have the following suggestions for you:

• Since you both have agreed on a password, let it be. Be sure to change it every 90 days. You can rotate a few characters/words/numbers/specials here and there and keep the basic outline the same. I am sure any reasonable person will agree on it. :D
• I believe that information security is more in control of the "user" than in the "mechanisms".
• Using Password Managers is, as you rightly said, more of a "power user" thing. The "average user" sees it as uncomfortable and more of a hassle rather than "something to keep them safe". Respect that fact. I'm sure in your long and happy years of marriage, she will become a "power user" too. :)

Hope it helps. And congratulations. :)

Answer 4

Fear

Yes it sound awful, but it's really the same thing that makes you choose strong passwords. Fear of someone stealing your money from your bank, fear of someonce accessing your private emails, etc.
It's not truly insane to want to educate her about her short-sightedness (no offence intended, but let's call it what it is).

You should probably mention how easily guessable passwords are. Articles of people with whom she can relate (eg: middle class, not-into-anything-obscure married wives) losing sensitive information/their-lives-photos/savings, etc will probably help her rethink her stance a bit.