Empathy as a Response to Frustration in Password Choice

Abstract

Previous research often reports that password-based security is frustrating, irritating or annoying, and as a result it often leads to weak password choices. We investigated the impact of empathy as a countermeasure to the anger-related states. We designed an online study with N = 194 participants. The experimental group received an empathic message while the control group did not. Participants presented with the empathic message created significantly stronger passwords than those who did not receive the message. Our finding differs from previous research because it shows participants creating stronger passwords with an empathic response to anger arousal. This antidote to frustrated states with regards to password choice provides an initial step towards more supportive and emotionally intelligent security designs.

Kovila P.L. Coopamootoo, Empathy as a Response to Frustration in Password Choice: Proceedings of AsiaUSEC’20, Financial Cryptography and Data Security 2020 (FC). February 14, 2020 Kota Kinabalu, Sabah, Malaysia Springer, 2020.

8 Appendix

1.1 8.1 Password Characteristics

Table 2. Password descriptives

1.2 8.2 Password ReUse Strategy

Table 3. Password choice strategy (in %)

1.3 8.3 Empathy Quotient

We measured dispositional empathy via the Empathy Quotient (EQ) questionnaire  [5]. The sample had a mean EQ of 40.361, $sd=12.778$.

We do not observe a difference between conditions. However we observe a difference between gender, where women scored a higher dispositional empathy (mean $= 42.305$, $sd=12.637$), EQ, than men (mean $= 38.495$, $sd=12.697$). The difference was statistically significant with the independent samples t-test, with $t(192)=2.094$, $p=.038$, CI[.222, 7.399], effect size Hedges $g=.300$, CI[.017, .583], which is between a small and medium effect.

Fig. 2.

Plot of empathy quotient vs reported anger.

We compare the mean EQ across the different levels of bmi_anger with an ANOVA. We find a significant difference in EQ across levels of reported anger, where participants with a low EQ expressed more anger, $F(3, 190) = 6.28$, $p < .000$. The boxplot in Fig. 2 depicts the decreasing mean EQ as bmi_anger increases from 1 to 4.

However, we did not find a correlation between EQ and receiving empathy through bmi_understood, bmi_received or bmi_cared-for.

1.4 8.4 Impact of Password Characteristics on Emotions

Password Strength Impacts Anger Reports Model Assumptions. There is no difference in the coefficients between models, with $X^2(2) = 2.324$, $p=.313$. This means that the proportional odds assumption is satisfied, that is the coefficients that describe the relationship between, the lowest versus all higher levels of bmi_anger are the same as those that describe the relationship between the next lowest level and all higher level. The model goodness of fit assumption was also satisfied via the Pearson Chi-Square statistic with $X^2(443) = 471.605$, $p=.168$.

Password Length Impacts Anger Reports. We compute an ordinal regression model, with bmi_anger as target variable and password length as predictor. The proportional odds assumption was satisfied with $X^2(2) = 1.523$, $p=.467$, and the model goodness of fit assumption was satisfied via the Pearson Chi-Square statistic with $X^2(47) = 52.562$, $p=.267$.

The model was statistically significant with $X^2(194,1) = 7.323$, $p=.007$. A one unit increase in password length was associated with a $12\%$ increase in the odds of reporting a higher level of anger, Wald $X^2(1) = 6.947$, $p = .008$, odds ratio 1.12. The model has a correct classification rate of $63.4\%$. However, The proportion of variance in anger level explained by password strength is quite small with pseudo $R^2 = 2.0\%$ (McFadden), $3.7\%$ (Cox & Snell) and $4.4\%$ (Nagelkerke).

Password Components Impact Anger Reports. We compute an ordinal regression model, with bmi_anger as target variable and the number of digits, lowercase letters, uppercase letters and symbols as predictors. The proportional odds assumption was satisfied with $X^2(8) = 3.478$, $p=.901$, and the model goodness of fit assumption was satisfied via the Pearson Chi-Square statistic with $X^2(425) = 467.062$, $p=.078$.

The model was statistically significant with $X^2(198,4) = 12.838$, $p=.012$. A one unit increase in number of digits was associated with a $31\%$ increase in the odds of reporting a higher level of anger, Wald $X^2(1) = 7.454$, $p = .006$, odds ratio 1.31. A one unit increase in number of lowercase letters was associated with an $14\%$ increase in the odds of reporting a higher level of anger, Wald $X^2(1) = 8.317$, $p = .004$, odds ratio 1.14. The model has a correct classification rate of $64.4\%$. However, The proportion of variance in anger level explained by password strength is quite small with pseudo $R^2 = 3.5 \%$ (McFadden), $6.4 \%$ (Cox & Snell) and $7.5\%$ (Nagelkerke).

Password Strength Impacts Reports of Excitement. We compute an ordinal regression model, with bmi_excitement as target variable and password strength as predictor. The proportional odds assumption was satisfied with $X^2(3) = 1.871$, $p=.600$, and the model goodness of fit assumption was satisfied via the Pearson Chi-Square statistic with $X^2(591) = 594.171$, $p=.456$.

The model was statistically significant with $X^2(194,1) = 4.086$, $p=.043$. A one unit increase in password length was associated with a $9\%$ decrease in the odds of reporting a higher level of excitement, Wald $X^2(1) = 4.000$, $p = .045$, odds ratio .910. However, The proportion of variance in excitement level explained by password strength is quite small with pseudo $R^2 = .07\%$ (McFadden), $2.1\%$ (Cox & Snell) and $2.2\%$ (Nagelkerke).