We performed a preliminary investigation of the relationship between the Big-five personality traits and the strength of selected and created online security passwords. Five-hundred and ten participants were recruited through MTurk and asked a) to complete a Big-five personality inventory, b) to select from a list of available passwords the one they felt was most secure, and c) to create unique, secure passwords for their own online protection. The security strength of participants' selected/created passwords was rated via Zxcvbn, and evaluated on a variety of additional security-based criteria (e.g., password length, inclusion of special characters). In all cases results failed to identify significant relationship between the strength of the selected/chosen password and any Big-five personality traits (when employing appropriately stringent control for multiple corrections). These null results suggest that other factors beyond an individual's personality may hold greater influence over the strength of selected/created online passwords. We present detailed observations and findings from our experiment, discuss potential considerations for contradictions, and suggest possibilities for future research into the password/personality relationship, including the potential use of enhanced password strength meters and tailored security nudges.

Recent advances in brain-computer interfaces (BCI) have enabled them as affordable consumer-grade devices for nonmedical purposes such as academic research, marketing, and entertainment. We report on the possibility of using BCIs to classify passwords into two classes—one class may be deemed as memorable and the other one as non-memorable—based on electroencephalogram (EEG) potentials collected by the BCI upon presenting the passwords to human participants. The memorable set consists of the most commonly used passwords, also known as "worst passwords lists", while the non-memorable set consists of randomly generated strings of characters, symbols, and numbers. When classifying passwords as memorable vs. nonmemorable, a classification accuracy of 76.5% was achieved. We found a positive correlation between password EEG features and password recall. We also report on users' choice of passwords, where 74% of participants were found to inadvertently choose the password with higher elicited voltage, when presented with two passwords to choose from.