Password Policies Adopted by South African Organizations: Influential Factors and Weaknesses

Abstract

Organizations worldwide are revisiting the design of their password policies. This is partly motivated by the security and usability limitations of user-generated passwords. While research on password policies has been ongoing, this has taken place in the Global North. Accordingly, little is known about the strengths and weaknesses of password policies deployed in the Global South, especially Africa. As such, this study researched password policies deployed on South African websites. Password policies of thirty frequently visited websites belonging to South African organizations were analyzed. Our observations show diverse password requirements. Even though the desire for strong passwords is the dominant motivator of complex password policies, South African organizations often adopt obsolete measures for attaining password security. The ten most common passwords in the literature were considered acceptable on most sites. In addition, some sites did not explicitly display password requirements and only a few sites adopted measures for providing real-time feedback and effective guidance during password generation.

Appendix

Researched Sites, Password Policies and Accepted Passwords

Category	Password strength meter	Rule-based password policy	Minimum length limits	Character set	Blacklist	Deter personal data	SSO	Explicitly display password rules	Accepted passwords
Bank site	No	Yes	8	ULNS	No	No	No	Yes	P@s$word5
Bank site	No	Yes	8	ULN	No	No	No	Yes	N/A
Bank site	No	Yes	8	UN/ LN	No	No	No	Yes	N/A
Betting site	No	Yes	6	UN/ LN	No	No	No	No	password123
Classified adverts	No	Yes	No	No	No	No	No	No	1, we, pass
Classified adverts	No	Yes	7	N/ L/S/U	No	No	No	Yes	1234567
e-Commerce	Yes	N/A	N/A	N/A	No	No	No	Yes	P@55word
e-Commerce	No	Yes	5	L/N/S/U	No	No	No	No	ilove
e-Commerce	No	Yes	N/A	N/A	No	No	Yes	N/A	N/A
e-Commerce	No	Yes	8	UN/LN	Yes	No	No	Yes	111111p; p@55word; iloveyou1
e-Commerce	No	Yes	6	U/L/N/S	No	No	No	No	password
E-Government	No	Yes	6	ULNS	No	No	No	Yes	N/A
E-mail	No	Yes	No	U/L/N/S	No	No	No	No	12345
Job vacancies	Yes	Yes	6	U/L/N/S	No	No	No	Yes	pa55word
Job vacancies	No	Yes	No	U/L/N/S	No	No	No	No	pass
Job vacancies	No	Yes	No	U/L/N/S	No	No	No	No	pass
News site	No	Yes	N/A	N/A	No	No	Yes	N/A	N/A
News site	No	Yes	6	U/L/N/S	No	No	No	No	password
News site	No	Yes	5	U/L/N/S	No	No	No	No	passw
News site	No	Yes	8	ULN	No	No	No	Yes	password1
Real estate	No	Yes	6	U/L/N/S	Yes	No	No	No	Pa$5word
Real estate	No	Yes	6	U/L/N/S	No	No	No	Yes	password
IT corporations	No	Yes	8	ULN	No	No	No	Yes	Password@1
IT corporations	No	Yes	8	ULN	No	No	No	Yes	Password1
TV services	Yes	N/A	N/A	N/A	Yes	No	No	Yes
TV services	No	Yes	6	U/L/N/S	No	No	Yes	No	password
University	No	Yes	6	U/L/N/S	No	No	No	Yes	password
University	No	Yes	12	ULNS	No	No	No	Yes	N/A
University	No	Yes	14	U/L/N/S	Yes	Yes	No	Yes	N/A
University	No	Yes	8	ULN/ UNS/LNS	No	No	No	Yes	password1#

1. Key: U: Uppercase letters; L: Lowercase letters; N: Number; S: Symbol.
2. N/A: Not applicable