# Age and Gender Impact on Password Hygiene
## 4 Discussion  
Our research answered the question about general cyber hygiene. The results showed weak password selection within most groups of users; i.e., most passwords were either short, based on a dictionary, using a limited set of characters, or found in leaked databases. Many human factors influence poor password hygiene. Service providers focus on attracting people via ease-of-use of systems. They do not want to scare new customers away by forcing them to create inconveniently complex passwords. In turn, customers rarely consider possible risks that arise from entire dataset theft. In addition, the _I have nothing important for hackers to take_ mindset could explain the noticeable drop in password strength that we observed for young (in particular male) persons of ages 18 to 25. Concerning the research question about older users, our assumptions regarding the influence of their lack of general IT education on their password hygiene align with our findings. The analysis showed a decrease in users' password strength above 45 years old regardless of gender. Based on the analysis between genders and their password choices, certain patterns and implications arise. Males generally have stronger passwords, and our results show that males between 26 and 45 have the strongest passwords. One trend that this study uncovered is that passwords regardless of gender become less complex as people get older, with the biggest difference being between males aged 26-45 and females over 45 (mean difference \(\mu=0.482\pm 0.045\)), translating to 3.03 times more complex passwords for males. A more worrisome finding is that females used the weakest passwords regardless of the age. This supports the findings of other researchers [34] that showed that females in Turkey and China had less complex passwords, although females in the UK had stronger passwords than their male counterparts. [PERSON] and [PERSON] [34] concluded that females in the UK might have more use of secured systems due to the digitisation of the society, whereas females in Turkey and China have less access to such systems. Regarding the research question about gender impact, our findings show a statistical difference in password-related behaviour between genders, although the effect is minimal. This aspect could explain ambivalent results in other studies of smaller samples. Figure 5: Password strength of different age groups. It should be emphasised that adding a single random character to a password would increase its brute force time by two orders of magnitude. Every user, no matter the gender, has to be encouraged to use substantially stronger passwords because a large fraction of both genders in this research had shown especially risky behaviour, including passwords shorter than eight characters, extensive use of their own personal data while creating passwords (names, dates of birth, emails, and even personal codes), and an overall reliance on dictionary words. However, the largest cause for concern is password reuse. Nearly half of identified females (46%) and a slightly smaller fraction of males (40%) used passwords found in previously leaked databases, and about 16% of all users had a non-unique password. Apparently, this is not a culture-dependent behaviour, because analysis of a breached Chinese dataset (130,000 passwords) showed that trivial passwords such as 111111 or 123456 are in the list of the most common passwords of this culturally specific dataset (35). Even their average password length (8.4 symbols) was similar to our findings (9.12 symbols). To mitigate the use of weaker passwords, one might consider informing users to use more complex passwords, but in our opinion, the only viable solution is to adopt password manager programs that generate strong and unique passwords for each different service. Websites and databases should also require more complex passwords through the use of algorithms such as zxcvbn that analyse password complexity. The adoption of these approaches would help secure data in case of breaches regardless of age and gender.