The password is dead, long live the password – A laboratory study on user perceptions of authentication schemes. Issue 133 (January 2020)

• Record Type: Journal Article
• Authors: Zimmermann, Verena; Gerber, Nina
• Is Part Of: International journal of human-computer studies. Issue 133(2020)
• Page Start: 26
• Page End: 44
• Publication Date: 2020-01
• Subjects: Authentication schemes -- User perception -- Rating -- Security -- Usability; Human-machine systems -- Periodicals; Systems engineering -- Periodicals; Human engineering -- Periodicals; Human engineering; Human-machine systems; Systems engineering; Periodicals; Electronic journals; 004.019
• DOI: 10.1016/j.ijhcs.2019.08.006
• Languages: English
• ISSNs: 1071-5819

Abstract

Highlights: User perceptions of authentication schemes differ from their objective features. Different types of authentication schemes are perceived differently by users. User preference of authentication schemes correlates with perceived usability. Security and privacy perception is not related to user preference. Abstract: Password authentication is still ubiquitous although alternatives have been developed to overcome its shortcomings such as high cognitive load for users. Using an objective rating scheme Bonneau et al. (2012) demonstrated that replacing the password poses a quest that yet remains unsolved. To shine light on this intractable issue we turn towards subjective user perceptions that influence acceptance and actual use of authentication schemes. We first conducted an extensive rating of objective features of authentication schemes to inform our selection of schemes for this research. Building on the findings thereof, 41 users interacted with twelve different authentication schemes in a laboratory study. The participants' ratings revealed that the password followed by fingerprint authentication scored highest in terms of preference, usability, intention to use and lowest in terms of expected problems and effort. Usability and effort seem to be important factors for users' preference rating whereas security and privacy ratings were not correlated with preference. One reason for these factors to fall behind might be their opacity and the resulting difficulty to evaluate them from a user perspective. Further, security and usability perceptions deviated from objective factors and should therefore be carefully considered before making decisions in terms of authentication. Suggestions for making security and privacy features more tangible and to allow for an easier integration in the users' decision process are discussed.