Keep on rating – on the systematic rating and comparison of authentication schemes

Abstract

Purpose Six years ago, Bonneau et al. (2012) proposed a framework to compare authentication schemes to the ubiquitous text password. Even though their work did not reveal an alternative outperforming the text password on every criterion, the framework can support decision makers in finding suitable solutions for specific authentication contexts. The purpose of this paper is to extend and update the database, thereby discussing benefits, limitations and suggestions for continuing the development of the framework. Design/methodology/approach This paper revisits the rating process and describes the application of an extended version of the original framework to an additional 40 authentication schemes identified in a literature review. All schemes were rated in terms of 25 objective features assigned to the three main criteria: usability, deployability and security. Findings The rating process and results are presented along with a discussion of the benefits and pitfalls of the rating process. Research limitations/implications While the extended framework, in general, proves suitable for rating and comparing authentication schemes, ambiguities in the rating could be solved by providing clearer definitions and cut-off values. Further, the extension of the framework with subjective user perceptions that sometimes differ from objective ratings could be beneficial. Originality/value The results of the rating are made publicly available in an authentication choice support system named ACCESS to support decision makers and researchers and to foster the further extension of the knowledge base and future development of the extended rating framework.

That Depends -- Assessing User Perceptions of Authentication Schemes across Contexts of Use

“…Yet, selecting a suitable authentication scheme amongst the plethora of available schemes is a challenging task. A previously conducted rating of technical and objective aspects [7,53,44,80] revealed that none of the tested schemes outperformed the others in all regards. Instead, each scheme demonstrated strengths in certain areas and weaknesses in others.…”

“…For all contexts of use, the participants rated all three authentication schemes. A list of potential reasons for the participants' choice was derived from a literature review described in [80] and previous interview studies including the follow-up interviews in [79]. The potential reasons were clustered in terms of whether they concerned the login credentials or the authentication scheme and displayed as a matrix.…”

“…However, despite these efforts, no clear "silver bullet" emerged from the vast selection, neither in terms of single-factor authentication [7,34,80] nor in terms of the ideal combination of schemes in multi-factor authentication (MFA) [69,70]. This leaves researchers, developers, and service providers with the difficult decision of choosing suitable authentication schemes or combinations thereof for their service or database.…”

“Nah, it’s just annoying!” A Deep Dive into User Perceptions of Two-Factor Authentication

“…Furthermore, users also struggle to remember their passwords locking them out of their accounts [29]. Still, due to the easy deployment of passwords, they are unlikely to vanish soon [5,66]. A usable coniguration for enabling 2FA that is technologically robust, however, has not been realized yet [5,65].…”

Framework for the Comparison and Selection of Schemes for Multi-Factor Authentication

“…• The study of [37] extends from the framework proposed in [7] by revisiting the rating process and reviewing additional authentication schemes.…”