{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T17:26:16Z","timestamp":1787937976639,"version":"build-2784847793"},"publisher-location":"New York, NY, USA","reference-count":53,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,12,4]],"date-time":"2023-12-04T00:00:00Z","timestamp":1701648000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100006374","name":"NSF (National Science Foundation)","doi-asserted-by":"publisher","award":["CNS-2152644, CNS-1705050"],"award-info":[{"award-number":["CNS-2152644, CNS-1705050"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006374","name":"University of California, San Diego","doi-asserted-by":"publisher","award":["Postdoctoral Fellows program,Irwin Mark and Joan Klein Jacobs Chair in Information and Computer Science"],"award-info":[{"award-number":["Postdoctoral Fellows program,Irwin Mark and Joan Klein Jacobs Chair in Information and Computer Science"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,12,4]]},"DOI":"10.1145\/3627106.3627198","type":"proceedings-article","created":{"date-parts":[[2023,12,2]],"date-time":"2023-12-02T18:13:22Z","timestamp":1701540802000},"page":"150-162","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["An Empirical Analysis of Enterprise-Wide Mandatory Password Updates"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-7293-3290","authenticated-orcid":false,"given":"Mirian","family":"Ariana","sequence":"first","affiliation":[{"name":"University of California, San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-4216-951X","authenticated-orcid":false,"given":"Ho","family":"Grant","sequence":"additional","affiliation":[{"name":"University of California, San Diego, USA and University of Chicago, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6617-8029","authenticated-orcid":false,"given":"Savage","family":"Stefan","sequence":"additional","affiliation":[{"name":"University of California, San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0865-7499","authenticated-orcid":false,"given":"Voelker","family":"Geoffrey M.","sequence":"additional","affiliation":[{"name":"University of California, San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,12,4]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376457"},{"key":"e_1_3_2_1_2_1","volume-title":"Proceedings of the 22nd USENIX Security Symposium. USENIX Association, Washington, D.C., 257\u2013272","author":"Akhawe Devdatta","year":"2013","unstructured":"Devdatta Akhawe and Adrienne\u00a0Porter Felt. 2013. Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness. In Proceedings of the 22nd USENIX Security Symposium. USENIX Association, Washington, D.C., 257\u2013272."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.5555\/3632186.3632201"},{"key":"e_1_3_2_1_4_1","volume-title":"Proceedings of the 27th USENIX Security Symposium. USENIX Association","author":"Becker Ingolf","year":"2018","unstructured":"Ingolf Becker, Simon Parkin, and M.\u00a0Angela Sasse. 2018. The Rewards and Costs of Stronger Passwords in a University: Linking Password Lifetime to Strength. In Proceedings of the 27th USENIX Security Symposium. USENIX Association, Baltimore, MD, USA, 239\u2013253."},{"key":"e_1_3_2_1_5_1","volume-title":"Proceedings of the 4th Workshop on Technology and Consumer Protection (ConPro). IEEE, 8\u00a0pages.","author":"Bhagavatula Sruti","year":"2020","unstructured":"Sruti Bhagavatula, Lujo Bauer, and Apu Kapadia. 2020. (How) Do People Change Their Passwords After a Breach?. In Proceedings of the 4th Workshop on Technology and Consumer Protection (ConPro). IEEE, 8\u00a0pages."},{"key":"e_1_3_2_1_6_1","volume-title":"Proceedings of the 31st USENIX Security Symposium. USENIX Association","author":"Bohuk Marina\u00a0Sanusi","year":"2022","unstructured":"Marina\u00a0Sanusi Bohuk, Mazharul Islam, Suleman Ahmad, Michael Swift, Thomas Ristenpart, and Rahul Chatterjee. 2022. Gossamer: Securely Measuring Password-based Logins. In Proceedings of the 31st USENIX Security Symposium. USENIX Association, Boston, MA, 1867\u20131884."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.49"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00032"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"crossref","unstructured":"Yee-Yin Choong Mary Theofanos and Hung-Kung Liu. 2014. United States Federal Employees\u2019 Password Management Behaviors \u2014 a Department of Commerce Case Study. NISTIR 7991.","DOI":"10.6028\/NIST.IR.7991"},{"key":"e_1_3_2_1_10_1","volume-title":"University. In Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery","author":"Colnago Jessica","year":"2018","unstructured":"Jessica Colnago, Summer Devlin, Maggie Oates, Chelse Swoopes, Lujo Bauer, Lorrie Cranor, and Nicolas Christin. 2018. \u201cIt\u2019s Not Actually That Horrible\u201d: Exploring Adoption of Two-Factor Authentication at a University. In Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery, Montr\u00e9al, Canada, 1\u201311."},{"key":"e_1_3_2_1_11_1","volume-title":"Proceedings of the 1st USENIX Workshop on Usability, Psychology, and Security (UPSEC). USENIX Association","author":"Cranor Lorrie\u00a0Faith","year":"2008","unstructured":"Lorrie\u00a0Faith Cranor. 2008. A Framework for Reasoning about the Human in the Loop. In Proceedings of the 1st USENIX Workshop on Usability, Psychology, and Security (UPSEC). USENIX Association, San Francisco, CA, USA, 15\u00a0pages."},{"key":"e_1_3_2_1_12_1","volume-title":"Proceedings of the 14th Network and Distributed Systems Security Symposium (NDSS). The Internet Society","author":"Cranor Lorrie\u00a0Faith","year":"2007","unstructured":"Lorrie\u00a0Faith Cranor, Serge Egelman, Jason\u00a0I. Hong, and Yue Zhang. 2007. Phinding Phish: An Evaluation of Anti-Phishing Toolbars. In Proceedings of the 14th Network and Distributed Systems Security Symposium (NDSS). The Internet Society, San Diego, CA, USA, 16\u00a0pages."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2010.5461951"},{"key":"e_1_3_2_1_14_1","volume-title":"Email analytics. https:\/\/myemma.com\/email-marketing-features\/email-analytics\/. [Accessed","year":"2022","unstructured":"Emma. 2022. Email analytics. https:\/\/myemma.com\/email-marketing-features\/email-analytics\/. [Accessed June 7 2022]."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702442"},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of the Twelfth Symposium on Usable Privacy and Security (SOUPS). USENIX Association","author":"Felt Adrienne\u00a0Porter","year":"2016","unstructured":"Adrienne\u00a0Porter Felt, Robert\u00a0W. Reeder, Alex Ainslie, Helen Harris, Max Walker, Christopher Thompson, Mustafa\u00a0Emre Acer, Elisabeth Morant, and Sunny Consolvo. 2016. Rethinking Connection Security Indicators. In Proceedings of the Twelfth Symposium on Usable Privacy and Security (SOUPS). USENIX Association, Denver, CO, 1\u201314."},{"key":"e_1_3_2_1_17_1","volume-title":"Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery","author":"Felt Adrienne\u00a0Porter","year":"2014","unstructured":"Adrienne\u00a0Porter Felt, Robert\u00a0W. Reeder, Hazim Almuhimedi, and Sunny Consolvo. 2014. Experimenting At Scale With Google Chrome\u2019s SSL Warning. In Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery, Toronto, Canada, 2667\u20132670."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1242572.1242661"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.5555\/2717491.2717494"},{"key":"e_1_3_2_1_20_1","volume-title":"Proceedings of the Seventeenth Symposium on Usable Privacy and Security (SOUPS). USENIX Association, 17\u201336","author":"Gerlitz Eva","year":"2021","unstructured":"Eva Gerlitz, Maximilian H\u00e4ring, and Matthew Smith. 2021. Please do not use !?_ or your License Plate Number: Analyzing Password Policies in German Companies. In Proceedings of the Seventeenth Symposium on Usable Privacy and Security (SOUPS). USENIX Association, 17\u201336."},{"key":"e_1_3_2_1_21_1","volume-title":"Nineteenth Symposium on Usable Privacy and Security (SOUPS). USENIX Association","author":"Gerlitz Eva","year":"2023","unstructured":"Eva Gerlitz, Maximilian H\u00e4ring, Matthew Smith, and Christian Tiefenau. 2023. Evolution of Password Expiry in Companies: Measuring the Adoption of Recommendations by the German Federal Office for Information Security. In Nineteenth Symposium on Usable Privacy and Security (SOUPS). USENIX Association, Anaheim, CA, 191\u2013210."},{"key":"e_1_3_2_1_22_1","volume-title":"Proceedings of the 30th USENIX Security Symposium. USENIX Association, 109\u2013126","author":"Golla Maximilian","year":"2021","unstructured":"Maximilian Golla, Grant Ho, Marika Lohmus, Monica Pulluri, and Elissa\u00a0M. Redmiles. 2021. Driving 2FA Adoption at Scale: Optimizing Two-Factor Authentication Notification Design Patterns. In Proceedings of the 30th USENIX Security Symposium. USENIX Association, 109\u2013126."},{"key":"e_1_3_2_1_23_1","volume-title":"Proceedings of the 16th Workshop on the Economics of Information Security (WEIS)","author":"Carlos","unstructured":"Carlos H.\u00a0Ganan and Michel Eeten. 2017. Make Notifications Great Again: Learning How to Notify in the Age of Large-Scale Vulnerability Scanning. In Proceedings of the 16th Workshop on the Economics of Information Security (WEIS). La Jolla, CA, USA, 1\u201315."},{"key":"e_1_3_2_1_24_1","first-page":"5","article-title":"Attitudes and Practices of Students towards Password Security","volume":"23","author":"Hart Delbert","year":"2008","unstructured":"Delbert Hart. 2008. Attitudes and Practices of Students towards Password Security. Computing Sciences in Colleges 23, 5 (May 2008), 169\u2013174.","journal-title":"Computing Sciences in Colleges"},{"key":"e_1_3_2_1_25_1","volume-title":"Alerts and Pop-ups: The Cost of Computer-Initiated Interruptions","author":"Hodgetts M.","unstructured":"Helen\u00a0M. Hodgetts and Dylan\u00a0M. Jones. 2007. Reminders, Alerts and Pop-ups: The Cost of Computer-Initiated Interruptions. In Human-Computer Interaction. Interaction Design and Usability, Julie\u00a0A. Jacko (Ed.). Springer Berlin Heidelberg, Beijing, China, 818\u2013826."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1753326.1753384"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/1978942.1979321"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/1143120.1143129"},{"key":"e_1_3_2_1_29_1","volume-title":"Eighteenth Symposium on Usable Privacy and Security (SOUPS","author":"Lee Kevin","year":"2022","unstructured":"Kevin Lee, Sten Sj\u00f6berg, and Arvind Narayanan. 2022. Password policies of most top websites fail to follow best practices. In Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022). USENIX Association, Boston, MA, USA, 561\u2013580."},{"key":"e_1_3_2_1_30_1","volume-title":"Proceedings of the 25th USENIX Security Symposium. USENIX Association","author":"Li Frank","year":"2016","unstructured":"Frank Li, Zakir Durumeric, Jakub Czyz, Mohammad Karami, Michael Bailey, Damon McCoy, Stefan Savage, and Vern Paxson. 2016. You\u2019ve Got Vulnerability: Exploring Effective Vulnerability Notifications. In Proceedings of the 25th USENIX Security Symposium. USENIX Association, Austin, TX, USA, 1033\u20131050."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2872427.2883039"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470081"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516726"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/359168.359172"},{"key":"e_1_3_2_1_35_1","volume-title":"Digital Identity Guidelines Frequently Asked Questions. https:\/\/pages.nist.gov\/800-63-FAQ\/. [Accessed","author":"NIST.","year":"2023","unstructured":"NIST. 2022. Digital Identity Guidelines Frequently Asked Questions. https:\/\/pages.nist.gov\/800-63-FAQ\/. [Accessed September 13 2023]."},{"key":"e_1_3_2_1_36_1","volume-title":"Proceedings of the 9th International Conference on the Technology and Practice of Passwords (PASSWORDS). Springer","author":"Parkin Simon","year":"2015","unstructured":"Simon Parkin, Samy Driss, Kat Krol, and M.\u00a0Angela Sasse. 2015. Assessing the User Experience of Password Reset Policies in a University. In Proceedings of the 9th International Conference on the Technology and Practice of Passwords (PASSWORDS). Springer, Cambridge, UK, 21\u201338."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.31014\/aior.1993.04.04.409"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.3758\/BF03195438"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1037\/e578102012-007"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3173574.3174086"},{"key":"e_1_3_2_1_41_1","volume-title":"Proceedings of the 29th USENIX Security Symposium. USENIX Association, 127\u2013143","author":"Reynolds Joshua","year":"2020","unstructured":"Joshua Reynolds, Nikita Samarin, Joseph Barnes, Taylor Judd, Joshua Mason, Michael Bailey, and Serge Egelman. 2020. Empirical Measurement of Systemic 2FA Usability. In Proceedings of the 29th USENIX Security Symposium. USENIX Association, 127\u2013143."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179288"},{"key":"e_1_3_2_1_43_1","volume-title":"Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery","author":"Shay Richard","year":"2015","unstructured":"Richard Shay, Lujo Bauer, Nicolas Christin, Lorrie\u00a0Faith Cranor, Alain Forget, Saranga Komanduri, Michelle\u00a0L. Mazurek, William Melicher, Sean\u00a0M. Segreti, and Blase Ur. 2015. A Spoonful of Sugar? The Impact of Guidance and Feedback on Password-Creation Behavior. In Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery, Seoul, Republic of Korea, 2903\u20132912."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2335356.2335366"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/2556288.2557377"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/1837110.1837113"},{"key":"e_1_3_2_1_47_1","volume-title":"Proceedings of the Network and Distributed Systems Security Symposium (NDSS). The Internet Society","author":"Stock Ben","year":"2018","unstructured":"Ben Stock, Giancarlo Pellegrino, Frank Li, Michael Backes, and Christian Rossow. 2018. Didn\u2019t You Hear Me? \u2014 Towards More Successful Web Vulnerability Notifications. In Proceedings of the Network and Distributed Systems Security Symposium (NDSS). The Internet Society, San Diego, CA, USA, 16\u00a0pages."},{"key":"e_1_3_2_1_48_1","volume-title":"Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery","author":"Ur Blase","year":"2016","unstructured":"Blase Ur, Jonathan Bees, Sean\u00a0M. Segreti, Lujo Bauer, Nicolas Christin, and Lorrie\u00a0Faith Cranor. 2016. Do Users\u2019 Perceptions of Password Security Match Reality?. In Proceedings of the ACM CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery, San Jose, California, USA, 3748\u20133760."},{"key":"e_1_3_2_1_49_1","volume-title":"Proceedings of the 21st USENIX Security Symposium. USENIX Association","author":"Ur Blase","year":"2012","unstructured":"Blase Ur, Patrick\u00a0Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass, Michelle\u00a0L. Mazurek, Timothy Passaro, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, and Lorrie\u00a0Faith Cranor. 2012. How Does Your Password Measure up? The Effect of Strength Meters on Password Creation. In Proceedings of the 21st USENIX Security Symposium. USENIX Association, Bellevue, WA, USA, 16\u00a0pages."},{"key":"e_1_3_2_1_50_1","volume-title":"Observing Password Creation in the Lab. In Eleventh Symposium On Usable Privacy and Security (SOUPS). USENIX Association","author":"Ur Blase","year":"2015","unstructured":"Blase Ur, Fumiko Noma, Jonathan Bees, Sean\u00a0M. Segreti, Richard Shay, Lujo Bauer, Nicolas Christin, and Lorrie\u00a0Faith Cranor. 2015. \"I Added \u2019!\u2019 at the End to Make It Secure\": Observing Password Creation in the Lab. In Eleventh Symposium On Usable Privacy and Security (SOUPS). USENIX Association, Ottawa, Canada, 123\u2013140."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866327"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2009.8"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866328"}],"event":{"name":"ACSAC '23: Annual Computer Security Applications Conference","location":"Austin TX USA","acronym":"ACSAC '23"},"container-title":["Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3627106.3627198","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3627106.3627198","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T17:36:41Z","timestamp":1755884201000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3627106.3627198"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,12,4]]},"references-count":53,"alternative-id":["10.1145\/3627106.3627198","10.1145\/3627106"],"URL":"https:\/\/doi.org\/10.1145\/3627106.3627198","relation":{},"subject":[],"published":{"date-parts":[[2023,12,4]]},"assertion":[{"value":"2023-12-04","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}