Is Implicit Authentication on Smartphones Really Popular? On Android Users’ Perception of “Smart Lock for Android”

Abstract

Implicit authentication (IA) on smartphones has gained a lot of attention from the research community over the past decade. IA leverages behavioral and contextual data to identify users without requiring explicit input, and thus can alleviate the burden of smartphone unlocking. The reported studies on users' perception of IA have painted a very positive picture, showing that more than 60% of their respective participants are interested in adopting IA, should it become available on their devices. These studies, however, have all been done either in lab environments, or with lowto medium-fidelity prototypes, which limits their generalizability and ecological validity. Therefore, the question of "how would smartphone users perceive a commercialized IA scheme in a realistic setting?" remains unanswered. To bridge this knowledge gap, we report on the findings of our qualitative user study (N = 26) and our online survey (N = 343) to understand how Android users perceive Smart Lock (SL). SL is the first and currently only widely-deployed IA scheme for smartphones. We found that SL is not a widely adopted technology, even among those who have an SL-enabled phone and are aware of the existence of the feature. Conversely, we found unclear usefulness, and perceived lack of security, among others, to be major adoption barriers that caused the SL adoption rate to be as low as 13%. To provide a theoretical framework for explaining SL adoption, we propose an extended version of the technology acceptance model (TAM), called SL-TAM, which sheds light on the importance of factors such as perceived security and utility on SL adoption. CCS CONCEPTS • Human-centered computing → Empirical studies in HCI; User studies; Usability testing; • Security and privacy → Usability in security and privacy.

A Comprehensive Survey of Context-Aware Continuous Implicit Authentication in Online Learning Environments

“…Non-intrusiveness: the system uses implicit authentication (IA) methods to authenticate a user without interrupting user-device interactions or requiring explicit participation during the authentication process [31]. IA harvests data about the user unobtrusively as a background task and it samples authentication data at regular and potentially short intervals (approaching continuous sampling) without requiring dedicated user action [31][32][33]. In general, IA does not rely on explicit input (e.g.…”

“It's the one thing that makes my life tick”: Security Perspectives of the Smartphone Era

“…An existing service which makes use of implicit authentication is Google's Smart Lock, where the user can indicate secure locations such as their home, where their locking mechanisms will be disabled. A study on this particular service indicates that users find the benefits of the Smart Lock to be unclear and view it as a security concern [35], suggesting users do sometimes feel a lock is necessary even in the safety of their own home. This aligns with wider findings that indicate known-persons, often with a close relationship to the victim, to be a significant risk factor in smartphone security, equivalent to "insider threats" faced by organisations [26,33,34,39].…”