A team of researchers from the University of Bonn has found that computer science students need to be repeatedly prompted to use strong password security measures. The study , conducted by German academics, found that without prompting, programmers did not feel the need to securely store their passwords.
The developers who participated in the study were recruited by Freelancer.com. The researchers asked 260 Java developers to create a user registration system for a fake social network. Of the 260, only 43 accepted the job.
For the study, the developers were divided into two groups: half were paid €100. The other half were paid €200. This was done to see if the higher pay made any difference in implementing password security.
These groups were further divided into two parts, and one group did not receive any instructions regarding storing passwords.
Surprisingly, out of the 43, 18 developers stored their passwords in plain text and were asked to resubmit their code. Of the 18, 15 were from the group that was not given instructions about passwords.
The study also found that developers often used encryption and hashing interchangeably and copied code from the internet to develop a secure system from scratch.
This result shows that password security is not a primary concern for programmers when working on a project. It is worth noting that this study is a follow-up to some previous studies conducted on students and it seems that professionals are not much different.
