Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication

Abstract

The newest contender for succeeding passwords as the incumbent web authentication scheme is the FIDO2 standard. Jointly developed and backed by the FIDO Alliance and the W3C, FIDO2 has found support in virtually every browser, finds increasing support by service providers, and has adoptions beyond browser-software on its way. While it supports MFA and 2FA, its single-factor, passwordless authentication with security tokens has received the bulk of attention and was hailed by its supporters and the media as the solution that will replace text-passwords on the web. Despite its obvious security and deployability benefits-a setting that no prior solution had in this strong combination-the paradigm shift from a familiar knowledge factor to purely a possession factor raises questions about the acceptance of passwordless authentication by end-users.This paper presents the first large-scale lab study of FIDO2 single-factor authentication to collect insights about end-users' perception, acceptance, and concerns about passwordless authentication. Through hands-on tasks our participants gather first-hand experience with passwordless authentication using a security key, which they afterwards reflect on in a survey. Our results show that users are willing to accept a direct replacement of text-based passwords with a security key for single-factor authentication. That is an encouraging result in the quest to replace passwords. But, our results also identify new concerns that can potentially hinder the widespread adoption of FIDO2 passwordless authentication. In order to mitigate these factors, we derive concrete recommendations to try to help in the ongoing proliferation of passwordless authentication on the web.

Hybrid password meters for more secure passwords – a comprehensive study of password meters including nudges and password information

“…Password managers were used in about 10% of cases, which slightly exceeds previous findings, e.g. [83,61]. While reuse might be attributed to the artificial study context (even though also found in real life), the use of password managers might be more prevalent amongst MTurk workers who might be younger and/or more tech-savvy.…”

Meaningful Context, a Red Flag, or Both? Users' Preferences for Enhanced Misinformation Warnings on Twitter

“…The evaluation of the enhanced warning tags was intended to gauge a preferential approach to soft moderation as well as understand the underpinning reasoning for it's acceptance (or lack thereof). A/B testing is a regular practice in usable security studies that informs the design of interface affordances, cues, and frictions [25,63,67]. Building on the exposure to contextual warning tags, a qualitative inquiry of how they fare in the misinformation front is important because the soft moderation employed by social media in general, and Twitter in particular, so far has yielded far from desirable results [39].…”

PoPL: Proof-of-Presence and Locality, or How to Secure Financial Transactions on Your Smartphone

“…A more secure alternative could be the adoption of secure hardware-based authentication solutions, e.g. FIDO2 [11], where verification codes can be provided by external hardware devices, e.g. Yubico Security Key.…”

“…The key steps of the accessibility attacks make use of Android accessibility service APIs 11 . These APIs are callable from any app that registers an accessibility service component that extends Accessi-bilityService and is granted the BIND_ACCES-SIBILITY_SERVICE permission.…”

“…Ultimately, the use of secure hardware offers the ideal solution, with even singlefactor authentication being secure enough for most scenarios, e.g. Yubico Key with FIDO2 [11]. However, this incurs a non-negligible expense and becomes a hindrance to app usability, possibly scaring away potential customers.…”