dorsal/arxiv
View SchemaLearning Password Best Practices Through In-Task Instruction
| Authors | Qian Ma, Yingfan Zhou, Shubhang Kaushik, Aamod Joshi, Aditya Majumdar, Noah Apthorpe, Yan Shvartzshnaider, Sarah Rajtmajer, Brett Frischmann |
|---|---|
| Categories | |
| ArXiv ID | 2601.06650vv1 |
| URL | https://arxiv.org/abs/2601.06650 |
| License | http://arxiv.org/licenses/nonexclusive-distrib/1.0/ |
Abstract
Users often make security- and privacy-relevant decisions without a clear understanding of the rules that govern safe behavior. We introduce pedagogical friction, a design approach that introduces brief, instructional interactions at the moment of action. We evaluate this approach in the context of password creation, a task with clear, objective quality criteria and broad familiarity. We conducted a randomized repeated-measures study with 128 participants across four interface conditions that varied the depth and interactivity of guidance. We assessed three outcomes: (1) rule compliance in a subsequent password task without guidance, (2) accuracy on survey questions matched to the rules shown earlier, and (3) behavior-knowledge alignment, which captures whether participants who correctly followed a rule also recognized it on the survey. Across all guided conditions, participants corrected most rule violations in the follow-up task, achieved moderate accuracy on matched rule questions, and showed high behavior-knowledge alignment. These results support pedagogical friction as a lightweight and generalizable intervention for security- and privacy-critical interfaces.
{
"annotation_id": "47b6e47c-bd01-49cc-b2d9-f2533e4a62e5",
"date_created": "2026-02-17T05:53:08.603000Z",
"date_modified": "2026-02-17T05:53:08.603000Z",
"file_hash": "6525ca7c6dd8e4e164fd854ba89fabb83ac5ec5b3dd5dacd23126c28e7ba6340",
"private": false,
"record": {
"abstract": "Users often make security- and privacy-relevant decisions without a clear understanding of the rules that govern safe behavior. We introduce pedagogical friction, a design approach that introduces brief, instructional interactions at the moment of action. We evaluate this approach in the context of password creation, a task with clear, objective quality criteria and broad familiarity. We conducted a randomized repeated-measures study with 128 participants across four interface conditions that varied the depth and interactivity of guidance. We assessed three outcomes: (1) rule compliance in a subsequent password task without guidance, (2) accuracy on survey questions matched to the rules shown earlier, and (3) behavior-knowledge alignment, which captures whether participants who correctly followed a rule also recognized it on the survey. Across all guided conditions, participants corrected most rule violations in the follow-up task, achieved moderate accuracy on matched rule questions, and showed high behavior-knowledge alignment. These results support pedagogical friction as a lightweight and generalizable intervention for security- and privacy-critical interfaces.",
"arxiv_id": "2601.06650",
"authors": [
"Qian Ma",
"Yingfan Zhou",
"Shubhang Kaushik",
"Aamod Joshi",
"Aditya Majumdar",
"Noah Apthorpe",
"Yan Shvartzshnaider",
"Sarah Rajtmajer",
"Brett Frischmann"
],
"categories": [
"cs.HC"
],
"license": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
"title": "Learning Password Best Practices Through In-Task Instruction",
"url": "https://arxiv.org/abs/2601.06650",
"version": "v1"
},
"schema_id": "dorsal/arxiv",
"source": {
"execution_id": "679cc1c0-6950-48e6-bc5b-c2d18bb3fccc",
"id": "arXiv Dataset",
"type": "Model",
"variant": "snapshot-2026-01-17",
"version": "0.1.0"
},
"user_id": 1000002
}