[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-571780-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-571780-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","lets-hash-helping-developers-with-password-security","Let's Hash - Helping Developers with Password Security","","Software developers often lack deep security expertise and struggle to implement password-based authentication safely. Existing developer resources such as Stack Overflow or documentation can be either easy to use but insecure, or secure yet difficult to apply, and research shows insecure outcomes when developers avoid copying resources. Inspired by Let's Encrypt and Certbot, this work introduces Let's Hash, offering code snippets and a wizard that generates complete secure password authentication code. A study with 179 freelance developers shows both versions substantially improve security and usability versus regular resources.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/lets-hash-helping-developers-with-password-security/571780/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/lets-hash-helping-developers-with-password-security/571780.png","ImageObject",442,249,{"name":42,"@type":43},"LangkahRina","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",6,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Why do password security implementations fail more often for developers than expected?","Question",{"text":63,"@type":64},"Developers are rarely security experts and often rely on programming resources that can be either easy but insecure or secure but hard to use. When developers assemble code poorly, even a single mistake can impact millions of accounts.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What is Let's Hash and how is it different from typical online resources?",{"text":68,"@type":64},"Let's Hash is a programming aid designed to help developers create secure password authentication code easily. It comes in two versions: a snippet collection and a wizard interface that guides decisions and outputs complete code.",{"name":70,"@type":61,"acceptedAnswer":71},"How many developers were involved in the evaluation, and what were the results?",{"text":72,"@type":64},"The study involved 179 freelance developers who solved three password programming tasks. Users of Let's Hash were on average 5 to 32 times more likely to create secure code than the control condition using regular resources.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},571780,1792016104,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":119,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":141},962090893776,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","Let’s Hash: Helping Developers  \nwith Password Security  \nLisa Geierhaas and Anna-Marie Ortloff, University of Bonn; Matthew Smith, University of Bonn, FKIE Fraunhofer; Alena Naiakshina, Ruhr University Bochum  \n[https://www.usenix.org/conference/soups2022/presentation/geierhaas](https://www.usenix.org/conference/soups2022/presentation/geierhaas)  \nThis paper is included in the Proceedings of the Eighteenth Symposium on Usable Privacy and Security  \n(SOUPS 2022) .  \nAugust 8–9, 2022 • Boston, MA, USA  \n978-1-939133-30-4  \nOpen access to the Proceedings of the Eighteenth Symposium on Usable Privacy and Security is sponsored by USENIX .  \nLet's Hash: Helping Developers with Password Security  \nLisa Geierhaas University of Bonn  \nAnna-Marie Ortloff University of Bonn  \nMatthew Smith University of Bonn, FKIE Fraunhofer  \nAlena Naiakshina Ruhr University Bochum  \nAbstract  \nSoftware developers are rarely security experts and often struggle with security-related programming tasks. The resources developers use to work on them, such as StackOverflow or Documentation, have a significant impact on the security of the code they produce. However, work by Acar et al. [4] has shown that these resources are often either easy to use but insecure or secure but hard to use. In a study by Naiakshina et al. [44], it was shown that developers who did not use resources to copy and paste code did not produce any secure solutions at all. This highlights how essential programming resources are for security. Inspired by the Let's Encrypt and Certbot that support admins in configuring TLS, we created a programming aid called Let's Hash to help developers create secure password authentication code easily. We created two versions. The first is a collection of code snippets developers can use, and the second adds a wizard interface on top that guides developers through the decisions which need to be made and creates the complete code for them. To evaluate the security and usability of Let's Hash, we conducted a study with 179 freelance developers, asking them to solve three password programming tasks. Both versions of Let's Hash significantly outperformed the baseline condition in which developers used their regular resources. On average, Let's Hash users were between 5 and 32 times as likely to create secure code than those in the control condition.  \nCopyright is held by the author/owner. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee.  \nUSENIX Symposium on Usable Privacy and Security (SOUPS) 2022. August 7–9, 2022, Boston, MA, United States.  \n1 Introduction  \nIt is well known that end-users struggle with password security. Recent work in the field of Usable Security for Developers and many real-world compromises have shown that many developers also struggle when tasked with implementing password-based authentication systems [7, 18, 29, 40–44, 49] . Unlike end-users' problems that can be dangerous enough, although only one account is usually affected, millions of accounts can be affected if developers make only one mistake.  \nThere have been multiple studies to advance the understanding of how the usability of APIs affects security during software development [4, 22, 33, 40, 42, 43, 45, 68] . However, one crucial aspect is the quality of the available documentation that developers use to solve their tasks. These are often either easy to use but insecure or secure but hard to use [5, 6, 27, 68] with many examples showing that developers copy and paste insecure code from online resources [4, 5, 24, 27] . Acar et al. write [4]: “our results confirm that API documentation is secure but hard to use, while informal documentation such as Stack Overflow is more accessible but often leads to insecurity.”  \nSo copy and pasting of insecure code is a serious concern to software security, with Fischer et al. [27] postulating that Stack Overflow is harmful. However, studies by Naiakshina et al. [43, 4","cbCaid8mdUeysu5s","https://ap.wps.com/l/cbCaid8mdUeysu5s","pdf",702447,"English","# Abstract\n# Introduction\n## Password security challenges for developers\n## The role of APIs and documentation quality\n## The Let's Hash approach and versions\n## Supported tasks and evaluation","[{\"question\":\"Why do password security implementations fail more often for developers than expected?\",\"answer\":\"Developers are rarely security experts and often rely on programming resources that can be either easy but insecure or secure but hard to use. When developers assemble code poorly, even a single mistake can impact millions of accounts.\"},{\"question\":\"What is Let's Hash and how is it different from typical online resources?\",\"answer\":\"Let's Hash is a programming aid designed to help developers create secure password authentication code easily. It comes in two versions: a snippet collection and a wizard interface that guides decisions and outputs complete code.\"},{\"question\":\"How many developers were involved in the evaluation, and what were the results?\",\"answer\":\"The study involved 179 freelance developers who solved three password programming tasks. Users of Let's Hash were on average 5 to 32 times more likely to create secure code than the control condition using regular resources.\"}]","Let's Hash - Helping Developers with Password Security | PDF",1791923693,7]