# Age and Gender Impact on Password Hygiene
## 1 Introduction
### Related Work  
The relationship between gender and security risk remains inconclusive. Some statistical data show no difference in behaviour. For example, 67% of adult women and 66% of adult men restricted applications from accessing private data on their smartphones [8].  
Other research showed that women understood the threat impact better than men, but they believed to be less vulnerable, expecting other people to implement security measures [9; 10]. In another case, self-reporting results showed men having higher levels of knowledge of secure passwords and lower levels of conscientiousness [11]. A study of employees at a medium-sized American company observed no differences between gender-related security vulnerability risk when job-specific factors were taken into account [12]. Similarly, a study of spam messages on the Facebook platform found that in general, women were more likely to click on spam messages, but the results differed depending on a topic, with more men opening media- or pharma-spam [13].  
Statistical data suggest a higher vulnerability of young and older people. For example, 60% of French teenagers (11-18 years) do not change passwords after choosing them [14]. On the other hand, the implementation of password hygiene training programmes for youth (13-16 years) show changes in password-setting behaviour [15]. Researchers found that there is a high percentage of reused passwords in both groups of older and younger respondents [16]. The researchers emphasise that public campaigns about password security have not been successful, as the problem continues to exist. Older adults are keen to protect themselves and understand the risk of not doing so, but they do feel anxiety, e.g., fear of forgetting the password [17]. A user becomes less security compliant when they are more security fatigued [18]. The fatigue is noticeable when security becomes superfluous. The enforcement of regular password changes does not increase security significantly and does not influence the creation of stronger passwords. Users cope with a password-changing policy by applying simple modifications to their current password and cycling through a dedicated set of passwords [19]. Researchers identified a large set of distinctive password pre-/post-fix patterns of various categories, for example, people, locations, digits, and culture-specific substitutions [20].  
Little research exists on the analysis of password strength in the context of languages other than English. [PERSON] et al. [21] presented a password estimation engine based on the zxcvbn [22] algorithm for Czech and Slovak languages. They presented the methodology that can be used to adapt the zxcvbn algorithm for smaller European languages.  
Previous research regarding the cyber hygiene of different age groups and genders has a few recurring limitations. As a rule, the studies are limited to several hundred data points, and they use self-reported user behaviour or insufficiently validated data such as gender or age from social media platforms where users have the freedom to misrepresent their demographic characteristics. The novelty of our work lies in the scale and validity of the data that we use in obtaining password strengths of all age and gender groups. It is primarily based on the large set (over 100,000) of user passwords that we managed to recover together with every user's accurate date of birth and gender.