Effect of Cognitive Effort on Password Choice

This paper reports on a lab experiment with 100 subjects which is the first to investigate the impact of cognitive effort and depletion on the choice of user passwords. Two groups of 50 subjects each were asked to generate a password. One group was cognitively depleted, the other was not. Password strength was measured and compared across groups. We find that subjects who are cognitively depleted create worse passwords than undepleted subjects. Surprisingly, subjects who report mild cognitive exertion create better password than undepleted subjects. We are interested in discussing how cognitive effort impacts authentication as well as how to negotiate the cognitive demands of password procedures to best support users.