2FA Might Be Secure, But It’s Not Usable: A Summative Usability Assessment of Google’s Two-factor Authentication (2FA) Methods

Abstract

Computer security experts recommend that people use two-factor authentication (2FA) on password protected systems to help keep hackers out. Providing two pieces of information to verify a person’s identity adds extra security to an account. However, it is not clear if the added security and procedures impact system usability. This paper aims to answer this question by assessing per ISO 9241-11’s suggested measurements the usability of Google’s optional 2FA methods. We found few differences across four different 2FA methods when comparing efficiency, effectiveness and satisfaction measures—illustrating that one method is not necessarily more or less usable then another. Overall, the measures indicated that the systems’ usability needed to be improved, especially with regard to the initial setup of 2FA. In conclusion, developers need to focus more attention on making 2FA easier and faster to use, especially since it is often optional for password users, yet makes accounts significantly more secure.

More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication

“…Our results matched findings of Khan et al [27] as well as Crawford and Renaud [10] related to the fact that more interruptions for authentication were perceived as more annoying. They confirm findings of Reese et al [38] and Acemyan et al [1] regarding that code-based 2FA received SUS scores lower than or equal 80. In relation to Reese et al we can also confirm that the code-based 2FA SUS scores are lower than those of password-only authentication.…”

“…The approach to change the SUS wordings is similar to Khan et al [27]. In contrast to them, we left SUS item five 1 inside our questionnaires since we tested a visible user interface. We calculated the SUS score as defined in Brooke [7].…”

Human Performance in Google’s Two-factor Authentication Setup Process

“…The first issue is that additional steps are required to log in. Second, people find it difficult to set up 2FA (Acemyan, Kortum, Xiong & Wallach, 2018). Having a more secure system is not valuable if people perceive it as difficult to set up and use.…”

“…There have been prior efforts to evaluate the usability of 2FA systems. Previous studies categorized 2FA tasks into two: the setup process and the login process (Acemyan et al, 2018;Reynolds et al, 2018). Setup is the process of activating a 2FA authentication service on an account.…”

“…Logging in is using the 2FA that is set up to access an account. Acemyan et al (2018) assessed the usability of Google's 2FA setup and login processes. Participants conducted setup and login activities on four 2FA methods.…”