Usability of web authentication systems

A web authentication system needs to be as usable as possible whilst not compromising the security that it needs to ensure.[1] The system needs to restrict access by malicious users whilst allowing access to authorised users. If the authentication system does not have sufficient security, malicious users could easily gain access to the system. On the other hand, if the authentication system is too complicated and restrictive, an authorised user would not be able to (or want to) use it.[3] Strong security is achievable in any system, but even the most secure authentication system can be undermined by the users of the system, often referred to as the "weak links" in computer security.[4]

Users tend to inadvertently increase or decrease security of a system. If a system is not usable, security could suffer as users will try to minimize the effort required to provide input for authentication, such as writing down their passwords on paper. A more usable system could prevent this from happening. Users are more likely to oblige to authentication requests from systems that are important (e.g. online banking), as opposed to less important systems (e.g. a forum that the user visits infrequently) where these mechanisms might just be ignored. Users accept the security measures only up to a certain point before becoming annoyed by complicated authentication mechanisms.[4] An important factor in the usability of a web authentication system is thus the convenience factor for the user around it.

The preferred web authentication system for web applications is the password,[4] despite its poor usability and several security concerns.[5] This widely used system usually contains mechanisms that were intended to increase security (e.g. requiring users to have high entropy passwords) but lead to password systems being less usable and inadvertently less secure.[6] This is because users find these high entropy passwords harder to remember.[7] Application creators need to make a paradigm shift to develop more usable authentication systems that take the user's needs into account.[5] Replacing the ubiquitous password based systems with more usable (and possibly more secure) systems could lead to major benefits for both the owners of the application and its users.

To measure the usability of a web authentication system, one can use the "usability–deployability–security" or "UDS" framework[5] or a standard metric, such as the system usability scale.[2] The UDS framework looks at three broad categories, namely usability deployability and security of a web authentication system and then rates the tested system as either offering or not offering a specific benefit linked to one (or more) of the categories. An authentication system is then classified as either offering or not offering a specific benefit within the categories of usability deployability and security.[5]

Measuring usability of web authentication systems will allow for formal evaluation of a web authentication system and determine the ranking of the system relative to others. While a lot of research regarding web authentication system is currently being done, it tends to focus on security and not usability.[1] Future research should be evaluated formally for usability using a comparable metric or technique. This will enable the comparison of various authentication systems, as well as determining whether an authentication system meets a minimum usability benchmark.[2]

It has been found that security experts tend to focus more on security and less on the usability aspects of web authentication systems.[5] This is problematic as there needs to be a balance between the security of a system and its ease-of-use. A study conducted in 2015[2] found that users tend to prefer Single sign-on (like those provided by Google and Facebook) based systems. Users preferred these systems because they found them fast and convenient to use.[2] Single sign-on based systems have resulted in substantial improvements in both usability and security.[5] SSO reduces the need for users to remember many usernames and passwords as well as the time needed to authenticate themselves, thereby improving the usability of the system.

Usability will become more and more important as more applications move online and require robust and reliable authentication systems that are both usable and secure. The use of brainwaves in authentication systems[8] have been proposed as a possible way to achieve this. However more research and usability studies are required.

• Martin Georgiev; Suman Jana; Vitaly Shmatikov. "Rethinking Security of Web-Based System Applications" (PDF). 24th International World Wide Web Conference.
• Keith, Mark; Shao, Benjamin; Steinbart, Paul John (January 2007). "The usability of passphrases for authentication: An empirical field study". International Journal of Human-Computer Studies. 65 (1): 17–28. doi:10.1016/j.ijhcs.2006.08.005.
• Muhammad Daniel Hafiz Abdullah; Abdul Hanan Abdullah; Norafida Ithnin; Hazinah Kutty Mammi (2008). Towards Identifying Usability and Security Features of Graphical Password in Knowledge Based Authentication Technique. 2008 Second Asia International Conference on Modelling & Simulation (AMS). pp. 396–403. doi:10.1109/AMS.2008.136.
• John Chuang; Hamilton Nguyen; Charles Wang; Benjamin Johnson (2013). "I Think, Therefore, I Am: Usability and Security of Authentication Using Brainwaves". Financial Cryptography and Data Security. Lecture Notes in Computer Science. 7862. Springer Berlin Heidelberg. pp. 1–16. CiteSeerX 10.1.1.359.9402. doi:10.1007/978-3-642-41320-9_1. ISBN 978-3-642-41319-3. ISSN 0302-9743.
• Paul T. McCabe (2002). "Usability and User Authentication: Pectoral Password vs PIN". Contemporary Ergonomics, 2003. CRC Press. ISBN 9780203455869.