Lorrie Cranor
More info
- Affiliation
- Carnegie Mellon University
- Known for
- Usable security, password research
Researcher who measured how people actually use security systems and found the rules often made things worse.
Cranor worked at AT&T Labs and led the work on P3P, the W3C's attempt to make website privacy policies machine-readable. She has been at Carnegie Mellon since 2003, where she founded the CyLab Usable Privacy and Security Lab and, in 2005, the SOUPS symposium. The field she helped build, usable security, starts from the premise that a control users work around protects nobody.
Her group ran the large empirical studies of password rules and showed that mandatory symbols and forced rotation produce predictable patterns rather than stronger passwords. In 2016 she served as chief technologist at the US Federal Trade Commission, where she publicly questioned government agencies' habit of forcing regular password changes. She later became director of CyLab.