Repository logo
 

The usability canary in the security coal mine: A cognitive framework for evaluation and design of usable authentication solutions

Published version
Peer-reviewed

Change log

Authors

Glass, Brian 
Jenkinson, Graeme 
Liu, Yuqi 
Sasse, Martina Angela 
Stajano, FM 

Abstract

Over the past 15 years, researchers have identified an increasing number of security mechanisms that are so unus- able that the intended users either circumvent them or give up on a service rather than suffer the security. With hindsight, the reasons can be identified easily enough: either the security task itself is too cumbersome and/or time-consuming, or it creates high friction with the users’ primary task. The aim of the research presented here is to equip designers who select and implement security mechanisms with a method for identifying the “best fit” security mechanism at the design stage. Since many usability problems have been identified with authentication, we focus on “best fit” authentication, and present a framework that allows security designers not only to model the workload associated with a particular authentication method, but more importantly to model it in the context of the user’s primary task. We draw on results from cognitive psychology to create a method that allows a designer to understand the impact of a particular authentication method on user productivity and satisfaction. In a validation study using a physical mockup of an airline check-in kiosk, we demonstrate that the model can predict user performance and satisfaction. Furthermore, design experts suggested personalized order recommendations which were similar to our model’s predictions. Our model is the first that supports identification of a holistic fit between the task of user authentication and the context in which it is performed. When applied to new systems, we believe it will help designers understand the usability impact of their security choices and thus develop solutions that maximize both.

Description

Keywords

46 Information and Computing Sciences, 4604 Cybersecurity and Privacy

Journal Title

Proceedings 1st European Workshop on Usable Security

Conference Name

EuroUSEC 2016: The 1st European Workshop on Usable Security

Journal ISSN

Volume Title

Publisher

Internet Society
Sponsorship
European Research Council (307224)
The Cambridge authors are grateful to the European Research Council for funding this research through grant StG 307224 (Pico). The UCL authors are grateful to the Engineering and Physical Sciences Research Council for funding this research through grant #EP/K033476/1.