Children use technology from a very young age and often have to authenticate. The goal of this study is to explore children's practices, perceptions, and knowledge regarding passwords. Given the limited work to date and that the world's cyber posture and culture will be dependent on today's youth, it is imperative to conduct cyber-security research with children. We conducted surveys of 189 3rd to 8th graders from two Midwest schools in the USA. We found that children have on average two passwords for school and three to four passwords for home. They kept their passwords private and did not share with others. They created passwords with an average length of 7 (3rd to 5th graders) and 10 (6-8th graders). But, only about 13% of the children created very strong passwords. Generating strong passwords requires mature cognitive and linguistic capabilities which children at this developmental stage have not yet mastered. They believed that passwords provide access control, protect their privacy and keep their "stuff" safe. Overall, children had appropriate mental models of passwords and demonstrated good password practices. Cyber-security education should strive to reinforce these positive practices while continuing to provide and promote age-appropriate developmental security skills. Given the study's sample size and limited generalizability, we are expanding our research to include children from 3rd to 12th graders across multiple US school districts.

中文翻译：

---

“密码保护我的东西” —儿童密码习惯研究

儿童从很小的时候就开始使用技术，并且常常必须进行身份验证。这项研究的目的是探索儿童的密码习惯，看法和知识。鉴于迄今为止的工作有限，并且世界的网络状况和文化将取决于当今的年轻人，因此必须对儿童进行网络安全研究。我们对美国两所中西部学校的189位3至8年级学生进行了调查。我们发现，孩子平均在学校有两个密码，在家里有三到四个密码。他们将密码保密，并且不与他人共享。他们创建的密码平均长度为7（三年级至5年级）和10（6-8年级）。但是，只有大约13％的孩子创建了非常安全的密码。生成强密码需要成熟的认知和语言能力，而在这个发展阶段的孩子还没有掌握这些能力。他们认为，密码可以提供访问控制，保护其隐私并保持其“资料”的安全。总体而言，孩子们具有适当的密码心理模型并表现出良好的密码习惯。网络安全教育应努力加强这些积极做法，同时继续提供和促进适合年龄的发展安全技能。鉴于这项研究的样本量和一般性有限，我们正在扩大研究范围，以涵盖美国多个学区的3年级至12年级的孩子。保护他们的隐私并确保他们的“物品”安全。总体而言，孩子们具有适当的密码心理模型并表现出良好的密码习惯。网络安全教育应努力加强这些积极做法，同时继续提供和促进适合年龄的发展安全技能。鉴于这项研究的样本量和一般性有限，我们正在扩大研究范围，以涵盖美国多个学区的3年级至12年级的孩子。保护他们的隐私并确保他们的“物品”安全。总体而言，孩子们具有适当的密码心理模型并表现出良好的密码习惯。网络安全教育应努力加强这些积极做法，同时继续提供和促进适合年龄的发展安全技能。鉴于这项研究的样本量和一般性有限，我们正在扩大研究范围，以涵盖美国多个学区的3年级至12年级的孩子。