A Systematic Study of the Consistency of Two-Factor Authentication User Journeys on Top-Ranked Websites

Lyastani, Sanam Ghorbani; Backes, Michael; Bugiel, Sven

doi:10.14722/ndss.2023.23362

Cited by 5 publications

(4 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A more recent work by Lyastani et al evaluated 85 websites regarding their MFA usability by creating accounts and evaluating their MFA communication and settings. They found that MFA implementations are largely inconsistent between different websites, and that many designs have previously been identified as obstructive or problematic [36].…”

Section: Multi-factor Authentication Usabilitymentioning

confidence: 99%

“…Previous work often focused on investigating the theoretical usability of recovery procedures in different areas [36,37,42,48,65,71,75]. In contrast, our work studies the first-hand user experience of MFA recovery procedures on websites: We went through the actual MFA recovery procedure processes implemented by 71 websites and reported lessons learned.…”

Section: Putting Our Work Into Contextmentioning

confidence: 99%

“…Previous work evaluated security documentation for setting up MFA [36,76], and encountered issues around unclear instructions. Our work shows many websites did not sufficiently document their MFA recovery processes, e. g. instructions described recovery processes that did not match the implemented deployments.…”

Section: Putting Our Work Into Contextmentioning

confidence: 99%

See 2 more Smart Citations

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

Amft,

Höltervennhoff,

Huaman

et al. 2023

Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Multi-Factor Authentication is intended to strengthen the security of password-based authentication by adding another factor, such as hardware tokens or one-time passwords using mobile apps.However, this increased authentication security comes with potential drawbacks that can lead to account and asset loss. If users lose access to their additional authentication factors for any reason, they will be locked out of their accounts. Consequently, services that provide Multi-Factor Authentication should deploy procedures to allow their users to recover from losing access to their additional factor that are both secure and easy-to-use.In this work, we investigate the security and user experience of Multi-Factor Authentication recovery procedures, and compare their deployment to descriptions on help and support pages.We first evaluate the official help and support pages of 1,303 websites that provide Multi-Factor Authentication and collect documented information about their recovery procedures. Second, we select a subset of 71 websites, create accounts, set up Multi-Factor Authentication, and perform an in-depth investigation of their recovery procedure security and user experience.We find that many websites deploy insecure Multi-Factor Authentication recovery procedures and allowed us to circumvent and disable Multi-Factor Authentication when having access to the accounts' associated email addresses. Furthermore, we commonly observed discrepancies between our in-depth analysis and the official help and support pages, implying that information meant to aid users is often either incorrect or outdated.Based on our findings, we provide recommendations for best practices regarding Multi-Factor Authentication recovery.

show abstract

Section: Multi-factor Authentication Usabilitymentioning

confidence: 99%

Section: Putting Our Work Into Contextmentioning

confidence: 99%

See 1 more Smart Citation

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

Amft,

Höltervennhoff,

Huaman

et al. 2023

Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…To achieve the goal of strengthening authentication systems, a hybrid mechanism of authentication is designed and proposed, based on the complementary application of three main authentication factors, namely, the biometric component ("something you are"), the RFID, and the cryptographic component ("something you have") [1]. Systems that incorporate multi-factor authentication are considered to be more powerful and robust compared to those that use only one factor and have the role of increasing the degree of data security in the process of verifying the identity of an authorized user who tries to access a computer system.…”

Section: Introductionmentioning

confidence: 99%

A Comparative Assessment of Homomorphic Encryption Algorithms Applied to Biometric Information

2023

View full text Add to dashboard Cite

This paper provides preliminary research regarding the implementation and evaluation of a hybrid mechanism of authentication based on fingerprint recognition interconnected with RFID technology, using Arduino modules, that can be deployed in different scenarios, including secret classified networks. To improve security, increase efficiency, and enhance convenience in the process of authentication, we perform a comparative assessment between two homomorphic encryption algorithms, the Paillier partial homomorphic algorithm and the Brakerski–Gentry–Vaikuntanathan fully homomorphic encryption scheme, applied to biometric templates extracted from the device mentioned above, by analyzing factors such as a histogram analysis, mean squared error (MSE), peak signal-to-noise ratio (PSNR), the structural similarity index measure (SSIM), the number of pixel change rate (NPCR), the unified average changing intensity (UACI), the correlation coefficient, and average encryption time and dimension. From security and privacy perspectives, the present findings suggest that the designed mechanism represents a reliable and low-cost authentication alternative that can facilitate secure access to computer systems and networks and minimize the risk of unauthorized access.

show abstract

IoTAuth: A Decentralized Cross-Chain Identity Authentication Scheme for 6G Non-Terrestrial IoT Networks

Deng,

Zhang,

Zhang

et al. 2024

IEEE Network

View full text Add to dashboard Cite

A Systematic Study of the Consistency of Two-Factor Authentication User Journeys on Top-Ranked Websites

Cited by 5 publications

References 0 publications

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

A Comparative Assessment of Homomorphic Encryption Algorithms Applied to Biometric Information

IoTAuth: A Decentralized Cross-Chain Identity Authentication Scheme for 6G Non-Terrestrial IoT Networks

Contact Info

Product

Resources

About