# Director, CyLab; Professor, Carnegie Mellon University

Source: https://startwithidentity.com/experts/lorrie-cranor/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Bio

Lorrie Faith Cranor directs CyLab at Carnegie Mellon and the CyLab Usable Privacy and Security Laboratory, founded the SOUPS symposium, and co-edited Security and Usability. Her group's password research measured what composition rules, meters, and expiry policies actually do to the passwords people choose.

Profile built from public academic and publication records.

## Where their work shows up

Password policy used to be set by intuition. Her lab produced the measurements that replaced it: which rules produce predictable substitutions, what a strength meter changes, and how forced rotation degrades the passwords it was meant to improve. That evidence is a large part of why [NIST 800-63](https://startwithidentity.com/regulations/) dropped complexity and rotation requirements. The consent work is equally load-bearing for [CIAM](https://startwithidentity.com/guides/fundamentals/what-is-ciam/), where preference and consent management is a product feature with regulatory weight. See [what is passwordless](https://startwithidentity.com/guides/fundamentals/what-is-passwordless/).