Have you ever thought nah it's just
annoying when you interacted with a
two-factor authentication mechanism?
You are not alone
and in this video we will dive deeply
into user perceptions of two-factor
authentication. Without further adue let's
start with a brief introduction into
two-factor authentication. Each
authentication mechanism belongs into
one of three authentication factor
categories. The first one is knowledge
that is something you know like a
password or pin. The second one is
ownership that is something in your
possession like your physical token or a
key. The third one is inherence that is a
biometric feature of yourself. It is
something you are like your
fingerprint or your voice. If we now
combine two of them of different
categories, we have to factor
authentication.
In the contexts of banking and financial
transactions, we have mostly a
combination of knowledge and possession.
Knowledge in the form of a password and
ownership in the form of a freshly
generated one-time password, this is
generated by different possibilities: the
first one is a one-time password
generator something you can put on your
key ring there are also calculator-like
devices that use information on the
debit card but to calculate a one-time
password and more recently we also have
mobile apps a platforms and I guess
many of you used something like this
already. There are a lot of interesting
studies that investigated user
perceptions and usability of these
devices and they showed that in general
people can interact with them and
usability is okayish I'm saying "ish"
because there were a lot of hints in related
work on shortcomings like for instance
participants in studies perceived
authentication is to long. To dive a
little bit deeper into that we did
semi-structured interviews with 42
participants.
Half of them were rather experienced
because they came from a country that
mandates 2FA for banking
transactions and they also reported to
use two of it frequently; the other half
was rather inexperienced because they
were from countries where 2FA in the banking
context was not mandatory and they
reported to use it occasionally so
both had experiences, but
they were rather different. In our
interviews we talked with them about
their experiences in the past focusing
on the one hand on negative ones but we
also didn't want to neglect the
positive ones, we
also spoke about preferences in terms of
what kind of
mechanisms they like to use and why and
specific factor realizations are liked.
We analyzed our interview results with
thematic analysis and identified three
overarching categories of results
The first one was mostly about
specific experiences the participants
had; then we also focused on the
experienced problems in our results, for
instance, availability issues. So we
confirmed a lot of the hints that we had found
in related work earlier and we spoke
with them specifically on the
realizations of the second factor
Remember as I said earlier those are
these like calculator-like devices or
smartphones that I had on the other
slide. On the one hand, we wanted to know
about like properties and expectations
of the second factor because for
security reasons it must be different
from the device where you authenticate
on and also we wanted to know about the
interactions the participants wanted to
perform and this is also
reflected here in our results so we show
what kind of properties of these factors
people expect, user preferences and also
how they want to interact with it.
Based on these three categories of
results, we distilled this to 10 final
recommendations.
Our recommendations come in two sets
the first one focuses on interaction design
and the second one on security but again
more like on the user side
and in the remainder of this we will
talk about about 10
recommendations.
The first set is as I said earlier based
on interaction design and here we have
two groups the first one is based on the
location. Two-factor authentication
mechanisms are mostly designed to be
used in a static environment where you have
your computer in front of you you're in
your office and you have the calculator
readily available next to you.
However the way people interact with
devices and the way they do transactions and
login procedures drastically changed in
the past years, so one recommendation
targets Mobile Solutions where we
consider that mobile devices like
smartphones and tablets are considered
as the primary devices where to factor
authentication is used
the second one considers energy sources
many participants had problems that
the calculator-like devices ran out of
battery or they also had unusual
batteries so ideally no energy sources
will be required but if so there should
be a standardization by charging it via
a USB-C cable.
We have a similar recommendation on
network use,
so people were locked out of their
accounts because the SMS for instance
didn't arrive in time of course we need
Network to perform an authentication in
the first place so here the network
means that it's not dependent on the
phone network but it could also be that
we have like a static device like a
smart TV or a gaming console that is
not connected to the internet we
just want to authenticate here so
ideally we wouldn't need any network at
all
and as I said it's just the ideal case
the second set considers customization
remember this little calculator-like
devices they have their own form factors
and here participants disliked that they
needed something new and even considered
that everyday objects might be a
solution. So what about
integrating a two-factor authentication
mechanism it's something you already
have because like a chain or like a ring
that you wear or some kind of decorative
object in your environment? Further they
considered personalization options would
be nice so what kind of item do I want
to use what kind of everyday object do I
want to integrate it in and even simple
stuff like the color of the device.
However all devices have to be scalable.
now there are standardizations,
but on the other hand
still Banks use different devices
so you need one device for each bank and
many people still coped by just
using the smartphone having a single
point of failure, so here scalability is
important.
The second set of recommendations
considers security here we first
consider a user experience
um first we consider that there must be
some way to recover from loss and when
you have to order a new calculator
online and wait two weeks until it
arrives and it's not so easy so here
should be better options and also
the security perceptions of the users
themselves are important because people
also considered this when using it so
people are willing to spend the extra
effort if they see that their action is
a security benefit but it's not always
evident to users. The
second that is interesting are
side channel attacks in particular mostly
shoulder surfing so here participants
considered that they do
the authentication in the presence of
a bystander and that doesn't
necessarily have to be a stranger it
could also be someone in their home
so they kind of wanted to have this
discreete solutions where you ideally
wouldn't even know that someone is
authenticating or solutions where you
don't have to dig out stuff like from
your pocket and look for the item maybe
you can just have it in your pocket and
authenticate that way such that no one
can see it. We've analyzed the state
of the art so in this table, you don't
have to read it right now we
considered solutions that are already on
the market or available in papers in the
context of all recommendations and as
you can see here a lot of hyphens meaning
a recommendation is not covered so
there is a lot of room for improvement
and I of course refer to our paper for
this in-depth because we have an
in-depth discussion to show like what is
actually the current situation with 2FA
mechanisms and this also concludes
my talk so current 2FA mechanisms
unfortunately poorly integrate into
daily routines we have a lot of problems
identified in the paper and of course
these few minutes I'm talking here
can't cover all of that
so we have to rethink to two-factor
authentication. In this paper we present
the first step for that with 10
recommendations considering interaction
design and security. Thanks for your
attention if you have a question just
drop me an email or contact me on
Twitter bye!