A Comparative Usability Study of Two-Factor Authentication
A Comparative Usability Study of Two-Factor Authentication
复制标题
双因素身份验证的可用性比较研究
DOI：
10.14722/usec.2014.23025
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
Gregory Norcie
中科院分区：
文献类型：
--
作者：
Emiliano De Cristofaro;Honglu Du;Julien Freudiger;Gregory Norcie
双因素身份验证（2F）旨在通过要求用户提供额外的身份验证因素来增强基于密码的身份验证的弹性，例如，由安全令牌生成的代码。然而，它也为服务提供商带来了不可忽视的成本，并要求用户在认证过程中执行额外的操作。在本文中，我们提出了一个探索性的2F技术的可用性比较研究。首先，我们进行研究前采访，以确定流行的技术以及使用它们的背景和动机。然后，我们根据219名Mechanical Turk用户完成的调查，提出了一项定量研究的结果，旨在衡量三种流行的2F解决方案的可用性：由安全令牌生成的代码，通过电子邮件或短信接收的一次性PIN，以及专用的智能手机应用程序（例如，Google Authenticator）。我们记录上下文和动机，并研究它们对感知可用性的影响。我们发现，2F技术总体上被认为是可用的，无论使用的动机和/或上下文。我们还提出了一个探索性的因素分析，强调三个指标-易用性，所需的认知努力和可信度-足以捕捉影响2F可用性的关键因素。
Two-factor authentication (2F) aims to enhance resilience of password-based authentication by requiring users to provide an additional authentication factor, e.g., a code generated by a security token. However, it also introduces non-negligible costs for service providers and requires users to carry out additional actions during the authentication process. In this paper, we present an exploratory comparative study of the usability of 2F technologies. First, we conduct a pre-study interview to identify popular technologies as well as contexts and motivations in which they are used. We then present the results of a quantitative study based on a survey completed by 219 Mechanical Turk users, aiming to measure the usability of three popular 2F solutions: codes generated by security tokens, one-time PINs received via email or SMS, and dedicated smartphone apps (e.g., Google Authenticator). We record contexts and motivations, and study their impact on perceived usability. We find that 2F technologies are overall perceived as usable, regardless of motivation and/or context of use. We also present an exploratory factor analysis, highlighting that three metrics – ease-of-use, required cognitive efforts, and trustworthiness – are enough to capture key factors affecting 2F usability.