[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572077-105":53,"doc-detail-572077-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","make-them-change-it-every-week-extended-version-qualitative-exploration","Make Them Change it Every Week! - Extended Version - Qualitative Exploration","","Usable and secure authentication across web applications remains a mission-critical challenge. Although password-based authentication is widespread, users struggle with managing many accounts and passwords, while alternatives like multi-factor authentication have limited adoption. This work studies how online developer advice influences usable security for end-users through a survey of 18 professional web developers, yielding 406 documents and 272 advice items analyzed in depth. Advice is scattered, often inconsistent, and frequently debatable, outdated, or contradictory. Recommendations are provided to improve advice quality for developers, providers, institutions, and academia.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/make-them-change-it-every-week-extended-version-qualitative-exploration/572077/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/make-them-change-it-every-week-extended-version-qualitative-exploration/572077.png","ImageObject",442,249,{"name":88,"@type":89},"Guten tag","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What issue does the paper identify with current authentication practice?","Question",{"text":109,"@type":110},"Password-based authentication remains widespread despite known usability problems for users managing many accounts and passwords. These usability barriers can negatively impact authentication security.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How did the authors collect and analyze data on online authentication advice?",{"text":114,"@type":110},"They surveyed 18 professional web developers, obtained 406 documents, and qualitatively analyzed 272 advice items in depth to understand accessibility and quality.",{"name":116,"@type":107,"acceptedAnswer":117},"What are the main findings about online developer advice for authentication?",{"text":118,"@type":110},"The authors find that advice is scattered and that finding recommendable, consistent guidance is difficult. Much of the advice is debatable, outdated, or contradictory, which can lead to insecure or unusable authentication.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572077,1792087494,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":142},687212321768,"https://ap-avatar.wpscdn.com/avatar/a0010bdbe886d2fe77?x-image-process=image/resize,m_fixed,w_180,h_180&k=1789897067658708522","“Make Them Change it Every Week!”: A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication  \nExtended Version∗  \nJan H. Klemmer Leibniz University Hannover  \nHannover, Germany [klemmer@sec.uni-hannover.de](klemmer@sec.uni-hannover.de)  \nMarco Gutfleisch Ruhr University Bochum  \nBochum, Germany [marco.gutfleisch@rub.de](marco.gutfleisch@rub.de)  \nChristian Stransky  \nCISPA Helmholtz Center for Information Security Hannover, Germany[stransky@sec.uni-hannover.de](stransky@sec.uni-hannover.de)  \nYasemin Acar  \nPaderborn University Paderborn, Germany yasemin.acar@uni-paderborn.de  \nM. Angela Sasse  \nRuhr University Bochum Bochum, Germany [martina.sasse@rub.de](martina.sasse@rub.de)  \nSascha Fahl  \nCISPA Helmholtz Center for Information Security Hannover, Germany [sascha.fahl@cispa.de](sascha.fahl@cispa.de)  \nABSTRACT  \nUsable and secure authentication on the web and beyond is missioncritical. While password-based authentication is still widespread, users have trouble dealing with potentially hundreds of online accounts and their passwords. Alternatives or extensions such as multi-factor authentication have their own challenges and find only limited adoption. Finding the right balance between security and usability is challenging for developers. Previous work found that developers use online resources to inform security decisions when writing code. Similar to other areas, lots of authentication advice for developers is available online, including blog posts, discussionson Stack Overflow, research papers, or guidelines by institutions like OWASP or NIST.  \nWe are the first to explore developer advice on authentication that affects usable security for end-users. Based on a survey with 18 professional web developers, we obtained 406 documents and qualitatively analyzed 272 contained pieces of advice in depth. We aim to understand the accessibility and quality of online advice and provide insights into how online advice might contribute to (in)secure and (un)usable authentication. We find that advice is scattered and that finding recommendable, consistent advice is a challenge for developers, among others. The most common advice is for password-based authentication, but little for more modern alternatives. Unfortunately, many pieces of advice are debatable (e.g., complex password policies), outdated (e.g., enforcing regular password changes), or contradicting and might lead to unusable or insecure authentication. Based on our findings, we make recommendations for developers, advice providers, official institutions, and academia on how to improve online advice for developers.  \n∗ This is the extended version of the paper originally published at ACM CCS 2023 (DOI: 10.1145/3576915.3623072) . It contains additional information and appendices.  \nThis work is licensed under a Creative Commons Attribution International 4 .0 License.  \nCCS’23, November 26–30, 2023, Copenhagen, Denmark © 2023 Copyright held by the owner/author(s) .  \nACM ISBN 979-8-4007-0050-7/23/11 . [https://doi.org/10.1145/3576915.3623072](https://doi.org/10.1145/3576915.3623072)  \nCCS CONCEPTS  \n• Security and privacy → Usability in security and privacy; Software security engineering; Authentication.  \nKEYWORDS  \nUsable Security; Advice; Software Development; Authentication  \nACM Reference Format:  \nJan H. Klemmer, Marco Gutfleisch, Christian Stransky, Yasemin Acar, M. Angela Sasse, and Sascha Fahl. 2023.“Make Them Change it Every Week!”: A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication: Extended Version. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS’23), November 26–30, 2023, Copenhagen, Denmark. ACM, New York, NY, USA, 20 pages. [https://doi.org/10.1145/3576915.3623072](https://doi.org/10.1145/3576915.3623072)  \n1 INTRODUCTION  \nPassword-based authentication is the status quo on the web and beyond [6, 13, 14]—despite its many known problems. This include","cbCaishni9A4tKeP","https://ap.wps.com/l/cbCaishni9A4tKeP","pdf",870185,20,"English","# Abstract\n# Introduction\n## Problem: Password-based authentication and usability barriers\n## Online developer advice as input to security decisions\n## Research goal and approach (qualitative exploration)","[{\"question\":\"What issue does the paper identify with current authentication practice?\",\"answer\":\"Password-based authentication remains widespread despite known usability problems for users managing many accounts and passwords. These usability barriers can negatively impact authentication security.\"},{\"question\":\"How did the authors collect and analyze data on online authentication advice?\",\"answer\":\"They surveyed 18 professional web developers, obtained 406 documents, and qualitatively analyzed 272 advice items in depth to understand accessibility and quality.\"},{\"question\":\"What are the main findings about online developer advice for authentication?\",\"answer\":\"The authors find that advice is scattered and that finding recommendable, consistent guidance is difficult. Much of the advice is debatable, outdated, or contradictory, which can lead to insecure or unusable authentication.\"}]","Make Them Change it Every Week! - Extended Version - Qualitative Exploration | PDF",1791925348,7]