“Nah, it’s just annoying!” A Deep Dive into User Perceptions of Two-Factor Authentication

Abstract

Two-factor authentication (2FA) is a recommended or imposed authentication mechanism for valuable online assets. However, 2FA mechanisms usually exhibit user experience issues that create user friction and even lead to poor acceptance, hampering the wider spread of 2FA. In this paper, we investigate user perceptions of 2FA through in-depth interviews with 42 participants, revealing key requirements that are not well met today despite recently emerged 2FA solutions. First, we investigate past experiences with authentication mechanisms emphasizing problems and aspects that hamper good user experience. Second, we investigate the different authentication factors more closely. Our results reveal particularly interesting preferences regarding the authentication factor ”ownership” in terms of properties, physical realizations, and interaction. These findings suggest a path towards 2FA mechanisms with considerably better user experience, promising to improve the acceptance and hence, the proliferation of 2FA for the benefit of security in the digital world.

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

“…In most cases, users could only use hardware tokens with another MFA method -a requirement we did not find for other MFA options. While websites did not justify this decision, we suspect known usability issues of hardware tokens and a perceived higher likelihood of becoming inaccessible [24,31,57,76].…”

Implementation of two-factor user authentication in computer systems

“…In most computer systems, identification and authentication are combined into a single step, where the user sequentially enters a username for identification and a password as an authentication factor. The combination of a username and password is the most common way to prove identity, especially in web environments (Marky et al, 2022).…”

The access control double bind: How everyday interfaces regulate access and privacy, enable surveillance, and enforce identity

“…Apart from a growing number of studies concerned with too often discriminatory implementations of facial recognition-based authentication (Buolamwini and Gebru 2018; Raji et al, 2020; Scheuerman et al, 2020), the study of access control in the HCI community primarily focuses on functional security or general efficacy and usability (e.g., Bonneau et al, 2012; Marky et al, 2022; Routi et al 2015; Sirivianos et al, 2014; Somayaji et al, 2013). The scant studies that address access control in digital games similarly tend to examine functional security for game software or services (Assiotis & Tzanov 2006; Dotan 2010; GauthierDickey et al, 2004), or games used as access control (Boella et al, 2005).…”

“…Studies of the effectiveness and usability of authentication are especially common (e.g., Bonneau et al, 2012; Marky et al, 2022; Routi et al 2015; Sirivianos et al, 2014; Somayaji et al, 2013). Although the findings in these studies provide insights on immediate transactional interactions, how authentication systems integrate into users’ lives more long-term is reasonably beyond their scope.…”