Empirical Measurement of Systemic 2FA Usability
Empirical Measurement of Systemic 2FA Usability
复制标题
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
J. Reynolds;N. Samarin;J. D. Barnes;Taylor Judd;Joshua Mason;Michael Bailey;Serge Egelman
中科院分区：
文献类型：
--
作者：
J. Reynolds;N. Samarin;J. D. Barnes;Taylor Judd;Joshua Mason;Michael Bailey;Serge Egelman
双因素身份验证（2FA）加强了组织对用户帐户的危害，但为组织的关键任务增加了额外的步骤。我们调查在何种程度上定量分析的2FA系统的操作日志支持和挑战最近的结果，从用户研究和调查确定可用性的挑战，在2FA系统。使用两所公立大学保存的数千万日志和记录，我们量化了强制性2FA实施期间对组织及其员工的大规模影响。我们展示了设备记忆、碎片化登录服务和身份验证超时对用户负担的倍增效应。我们发现，用户负担并没有偏离其他合规性和风险管理的时间要求已经常见的大型组织。我们调查了超过二十分之一的2FA仪式被中止或失败的原因，以及用户体验的差异。我们希望我们的分析能够让更多的组织能够通过2FA保护自己。
Two-Factor Authentication (2FA) hardens an organization against user account compromise, but adds an extra step to organizations’ mission-critical tasks. We investigate to what extent quantitative analysis of operational logs of 2FA systems both supports and challenges recent results from user studies and surveys identifying usability challenges in 2FA systems. Using tens of millions of logs and records kept at two public universities, we quantify the at-scale impact on organizations and their employees during a mandatory 2FA implementation. We show the multiplicative effects of device remembrance, fragmented login services, and authentication timeouts on user burden. We find that user burden does not deviate far from other compliance and risk management time requirements already common to large organizations. We investigate the cause of more than one in twenty 2FA ceremonies being aborted or failing, and the variance in user experience across users. We hope our analysis will empower more organizations to protect themselves with 2FA.