[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571782-105":53,"doc-detail-571782-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","why-do-developers-get-password-storage-wrong-a-qualitative-usability-study","Why Do Developers Get Password Storage Wrong? A Qualitative Usability Study","","Passwords remain a central component of security systems and a frequent source of usability problems. While end-user password behavior has been widely investigated, developers who implement password storage must also avoid critical security mistakes. Developers can fail to hash and salt credentials, leading to severe compromise of password databases. This paper reports a first qualitative usability study with 20 computer science students to examine developer approaches and to guide research on supporting secure password system development.",{"@graph":63,"@context":122},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/why-do-developers-get-password-storage-wrong-a-qualitative-usability-study/571782/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/why-do-developers-get-password-storage-wrong-a-qualitative-usability-study/571782.png","ImageObject",442,249,{"name":88,"@type":89},"anakgang17","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-21","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":47},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114,118],{"name":105,"@type":106,"acceptedAnswer":107},"What security mistakes by developers does the paper focus on?","Question",{"text":108,"@type":109},"It focuses on how developers may store passwords insecurely, such as forgetting to hash and salt password databases, which can cause severe security consequences.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How was the qualitative usability study conducted?",{"text":113,"@type":109},"The authors conducted an in-depth qualitative development study with 20 computer science students using a role-playing scenario to add registration and authentication code to an existing social networking stub.",{"name":115,"@type":106,"acceptedAnswer":116},"What comparison was used to study developer decision-making?",{"text":117,"@type":109},"Half the students were told to store passwords securely, while the other half had to decide on their own; additionally, half used the Spring Framework and half used Java Server Faces (JSF).",{"name":119,"@type":106,"acceptedAnswer":120},"What does the paper conclude about security knowledge and APIs?",{"text":121,"@type":109},"Security understanding does not guarantee secure implementations, and even APIs that provide secure methods are insufficient when their use is opt-in; the study also emphasizes that explicitly requesting security is necessary.","https://schema.org",{"og:url":78,"og:type":124,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":126,"canonical":78},"index,follow",{"doc_id":128,"site_id":56},571782,1792316225,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":88,"user_avatar":133,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":47,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":40,"language":139,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":61,"update_tm":143,"read_time":144},962090883568,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","Why Do Developers Get Password Storage Wrong? A Qualitative Usability Study  \nAlena Naiakshina∗ University of Bonn [naiakshi@cs.uni-bonn.de](naiakshi@cs.uni-bonn.de)  \nAnastasia Danilova∗ University of Bonn [danilova@cs.uni-bonn.de](danilova@cs.uni-bonn.de)  \nChristian Tiefenau  \nUniversity of Bonn [tiefenau@cs.uni-bonn.de](tiefenau@cs.uni-bonn.de)  \nMarco Herzog  \nUniversity of Bonn [herzog@cs.uni-bonn.de](herzog@cs.uni-bonn.de)  \nSergej Dechand  \nUniversity of Bonn dechand@cs.uni-bonn.de  \nMatthew Smith  \nUniversity of Bonn [smith@cs.uni-bonn.de](smith@cs.uni-bonn.de)  \nABSTRACT  \nPasswords are still a mainstay of various security systems, as well as the cause of many usability issues. For end-users, many of these issues have been studied extensively, highlighting problems and informing design decisions for better policies and motivating research into alternatives. However, end-users are not the only ones who have usability problems with passwords! Developers who are tasked with writing the code by which passwords are stored must do so securely. Yet history has shown that this complex task often fails due to human error with catastrophic results. While an end-user who selects a bad password can have dire consequences, the consequences of a developer who forgets to hash and salt a password database can lead to far larger problems. In this paper we present a first qualitative usability study with 20 computer science students to discover how developers deal with password storage and to inform research into aiding developers in the creation of secure password systems.  \n1 INTRODUCTION  \nIn the last decade usable security research has focused mainly on issues faced by end-users. In their paper “Developers are not the enemy”, Green and Smith [32] argue that usable security research needs to be extended to study and help developers who have to interact with complex security APIs.  \nStoring and authenticating user login data is one of the most common tasks for software developers [45] . At the same time, this task is prone to security issues [32] . Frequent compromises of password databases highlight that developers often do not store passwords securely-quite often storing them in plain text [20, 23, 38, 78] .  \nTo gain an understanding on where and why developers struggle to store passwords securely, we conducted the first usability study of developer behavior when tasked with writing code to store  \n∗ These authors contributed equally to this work.  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org).  \nCCS’17, October 30-November 3, 2017, Dallas, TX, USA  \n© 2017 Copyright held by the owner/author(s) . Publication rights licensed to Association for Computing Machinery.  \nACM ISBN 978-1-4503-4946-8/17/10. . . $15.00 [https://doi.org/10.1145/3133956.3134082](https://doi.org/10.1145/3133956.3134082)  \npasswords and authenticate users. Since this is the first work in this domain, we chose to conduct a qualitative study with the ability to conduct in-depth interviews to get feedback from developers.  \nWe were interested in exploring two particular aspects: Firstly, do developers get things wrong because they do not think about security and thus do not include security features (but could if they wanted to)? Or do they write insecure code because the complexity of the task is too great for them? Secondly, a common suggestion to increase security is to","cbCaipD6Xn1UoKMn","https://ap.wps.com/l/cbCaipD6Xn1UoKMn","pdf",2473365,"English","# Abstract\n# Introduction\n## Prior usable security research\n## Common security failures in password storage\n## Study design and research questions\n# Key insights","[{\"question\":\"What security mistakes by developers does the paper focus on?\",\"answer\":\"It focuses on how developers may store passwords insecurely, such as forgetting to hash and salt password databases, which can cause severe security consequences.\"},{\"question\":\"How was the qualitative usability study conducted?\",\"answer\":\"The authors conducted an in-depth qualitative development study with 20 computer science students using a role-playing scenario to add registration and authentication code to an existing social networking stub.\"},{\"question\":\"What comparison was used to study developer decision-making?\",\"answer\":\"Half the students were told to store passwords securely, while the other half had to decide on their own; additionally, half used the Spring Framework and half used Java Server Faces (JSF).\"},{\"question\":\"What does the paper conclude about security knowledge and APIs?\",\"answer\":\"Security understanding does not guarantee secure implementations, and even APIs that provide secure methods are insufficient when their use is opt-in; the study also emphasizes that explicitly requesting security is necessary.\"}]","Why Do Developers Get Password Storage Wrong? A Qualitative Usability Study | PDF",1791923696,6]