Hi, my name is Leon Würsching and today I am presenting our work "FIDO2 the Rescue?
Platform vs. Roaming Authentication on Smartphones".
This is a joint work of me and my co-first author Florentin Putz together with Steffen
Haesler and Matthias Hollick.
FIDO2 is a passwordless authentication method supported by all major web browsers.
It uses public-key cryptography to authenticate users based on challenges that can only be
solved with the use of private keys.
There are two variants of FIDO2 with fundamentally different user interactions.
On the one hand there is platform authentication where the private key is securely stored within
the smartphone and the user only has to confirm the authentication with their fingerprint.
Then there is roaming authentication where the private key is embedded in an external
security key that the user has to bring close to the smartphone.
In this work we study FIDO2 on smartphones comparing Apple's Touch ID for the web as
a platform authenticator and the Yubico YubiKey 5C NFC as a roaming authenticator.
Our focus is on the following research questions: Firstly, comparing FIDO2's usability and acceptance
using roaming and platform authentication. Secondly, collecting the strengths and weaknesses
of both variants. And finally studying how users make adoption decisions for specific
account types.
To this end we have conducted a lab study and I will present our study design next.
We've recruited participants within and without our university using email lists, social media
and snowball sampling.
Our target group was participants over 18 with diverse backgrounds, especially non-experts.
We've recruited 87 participants out of which 37% are female.
Our study sample is between 18 and 69 years old, reporting various fields of work or study.
We decided for a between-groups design to identify differences between platform and
roaming authentication on smartphones, therefore we randomly distributed participants into
two groups.
In the experiment, group P used platform authentication and group R used roaming authentication.
Before the experiment we educated participants to minimize the influence of prior knowledge.
Then the participants used FIDO2 in the experiment before filling in a questionnaire.
To get all participants on the same level we showed them instructional videos and answered
remaining questions.
During the experiment the participants used their variant of FIDO2 to register and log
into a mockup website that we've prepared for the study.
Our questionnaire contained the system usability scale, van der Laan's acceptance scale, and
an adoption metric.
Additionally, we included open-ended text questions collecting the strengths and weaknesses
of the presented authentication method as well as the participants general impression
and adoption reasons.
Regarding demographics we collected our participants age, education, gender and their field of
work or study.
As control variables we measured the participants affinity for technology interaction, their
privacy concerns and whether they are familiar with iOS and selected two-factor authentication
methods.
We used a combination of quantitative and qualitative categories to answer our research
questions about the usability and acceptance of FIDO2, its strengths and weaknesses and
the participants adoption decisions.
Okay, let's discuss our findings, starting with research question 1.
For usability we measured the system usability scale, finding that on smartphones the usability
of platform and roaming authentication is similarly high.
For acceptance we measured van der Laan's acceptance scale, finding that the acceptance
is higher for platform authentication.
Next we will have a closer look at the strengths and weaknesses identified by each group to
better classify these findings.
First of all, a few strengths have been mentioned by participants of both groups.
Most find FIDO2 to be secure and easy.
Others mentioned that FIDO2 eliminates typical password issues such as memorization or
password resets.
Additionally, participants of the platform authentication group mentioned speed as a
strength, as well as the fact that the authenticator is always with you.
The only exclusive roaming authentication strength indicated in our study is that a
single authenticator can be used for many accounts.
Both groups mention account recovery and authenticator revocation as a weakness of FIDO2.
The obvious weakness of platform authentication is that it cannot be used to authenticate
on other devices.
Additionally, participants of group P report issues with the fingerprint sensor and general
mistrust against using biometric authentication.
On the other hand, most participants of group R are concerned about potentially losing the
YubiKey or it being stolen or destroyed.
Furthermore, users have to purchase the YubiKey and carry it with them at all times.
For research question 2, we find that weaknesses of platform authentication are addressable
while the weaknesses of roaming authentication are by design.
After learning about the pros and cons of platform and roaming authentication, we wanted
to dig deeper, so we asked our participants for which account types they would adopt the
presented authentication method and why.
We analyzed their responses and found some interesting patterns regarding our third research
question.
Group P describes that they would adopt platform authentication for frequently used accounts
where the advantages availability and speed are especially relevant.
However, a few participants of group P would not use platform authentication for sensitive
accounts, citing mistrust in the security of FIDO2.
In contrast, the participants of the roaming authentication group would generally not use
roaming authentication for frequently used accounts.
However, they would adopt roaming authentication for sensitive accounts describing that in
this case the security benefits justify the need to carry the YubiKey.
Overall, we find that users do not decide whether or not to adopt FIDO2 for all of their
accounts.
Instead, they make a decision per account type, individually weighing the pros and cons
of the authentication method.
What are the implications of our work?
Summarizing the answers to our research questions, we found that while the usability of both
variants is similarly high, there is higher acceptance for platform authentication.
Both variants have strengths and weaknesses and users make adoption decisions per account
type.
So, who will win the battle of platform versus roaming authentication on smartphones?
Let's see.
To win more users for platform authentication, we propose better education on how platform
authentication, FIDO2 and public-key based authentication in general work.
The other major weakness is that Touch ID for the web cannot be used on other devices.
However, Apple has since released passkeys, which is very similar to Touch ID for the web
but synchronizes the user's private keys securely across their devices.
As a result, passkeys address this weakness of platform authentication.
The main issues of roaming authentication are by design.
Roaming authenticators like the YubiKey will always be a piece of hardware that has to
be carried and can be lost, destroyed or stolen.
Solving these issues is very hard, even though there is promising related work on using smartphones
as roaming authenticators.
For these reasons, we argue that there is more potential in platform authentication
than in roaming authentication, so future work should focus on solving the issues of
platform authentication.
To facilitate future work, we provide a replication package with our evaluation scripts and the
data set collected in our study.
We also release our mockup website's source code.