Abstract:Over the past 15 years, researchers have identified an increasing number of security mechanisms that are so unusable that the intended users either circumvent them or give up on a service rather than suffer the security. With hindsight, the reasons can be identified easily enough: either the security task itself is too cumbersome and/or time-consuming, or it creates high friction with the users` primary task. The aim of the research presented here is to equip designers who select and implement security mechanisms with a method for identifying the ``best fit`` security mechanism at the design stage. Since many usability problems have been identified with authentication, we focus on ``best fit`` authentication, and present a framework that allows security designers not only to model the workload associated with a particular authentication method, but more importantly to model it in the context of the user`s primary task. We draw on results from cognitive psychology to create a method that allows a designer to understand the impact of a particular authentication method on user productivity and satisfaction. In a validation study using a physical mockup of an airline check-in kiosk, we demonstrate that the model can predict user performance and satisfaction. Furthermore, design experts suggested personalized order recommendations which were similar to our model`s predictions. Our model is the first that supports identification of a holistic fit between the task of user authentication and the context in which it is performed. When applied to new systems, we believe it will help designers understand the usability impact of their security choices and thus develop solutions that maximize both.

Responsibility and Tangible Security: Towards a Theory of User Acceptance of Security Tokens

A Lightweight Three-Factor User Authentication Protocol for the Information Perception of IoT

M-PPG: A Non-intrusive Authentication for Wearable Devices Via PPG Sensors with Motor Excitations

User Characteristics and Their Impact on the Perceived Usable Security of Physical Authentication Devices

Toward secure user-habit-oriented authentication for mobile devices

That Depends -- Assessing User Perceptions of Authentication Schemes across Contexts of Use

The Factors Affect User Behaviour in a Picture-Based User Authentication System: PixelPin

Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound.

Widely Reused and Shared, Infrequently Updated, and Sometimes Inherited: A Holistic View of PIN Authentication in Digital Lives and Beyond

P2Auth: Two-Factor Authentication Leveraging PIN and Keystroke-Induced PPG Measurements

G-PPG: A Gesture-related PPG-based Two-Factor Authentication for Wearable Devices.

The usability canary in the security coal mine: A cognitive framework for evaluation and design of usable authentication solutions

"`They brought in the horrible key ring thing!" Analysing the Usability of Two-Factor Authentication in UK Online Banking

On the Security of “Secure and Lightweight Authentication with Key Agreement for Smart Wearable Systems”

Evaluating User Perception of Multi-Factor Authentication: A Systematic Review

Secure Session on Mobile: an Exploration on Combining Biometric, Trustzone, and User Behavior

Opportunistic Sensor-Based Authentication Factors in and for the Internet of Things

On the Usability of Two-Factor Authentication.

A Secure Two-Factor Authentication Scheme from Password-Protected Hardware Tokens

Smart User Authentication for an Improved Data Privacy

Camera Based Two Factor Authentication Through Mobile and Wearable Devices