More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication

Abstract

Risk-based Authentication (RBA) is an adaptive security measure to strengthen password-based authentication. RBA monitors additional features during login, and when observed feature values differ significantly from previously seen ones, users have to provide additional authentication factors such as a verification code. RBA has the potential to offer more usable authentication, but the usability and the security perceptions of RBA are not studied well. We present the results of a between-group lab study (n=65) to evaluate usability and security perceptions of two RBA variants, one 2FA variant, and password-only authentication. Our study shows with significant results that RBA is considered to be more usable than the studied 2FA variants, while it is perceived as more secure than password-only authentication in general and comparably secure to 2FA in a variety of application types. We also observed RBA usability problems and provide recommendations for mitigation. Our contribution provides a first deeper understanding of the users' perception of RBA and helps to improve RBA implementations for a broader user acceptance.

arXiv comment16 pages, 10 figures, 6 tables

References in corpus (1)

• Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild

Cited by in corpus (5)

• Pump Up Password Security! Evaluating and Enhancing Risk-Based Authentication on a Real-World Large-Scale Online Service
• Privacy Considerations for Risk-Based Authentication Systems
• Evaluation of Real-World Risk-Based Authentication at Online Services Revisited: Complexity Wins
• Is It Really You Who Forgot the Password? When Account Recovery Meets Risk-Based Authentication
• What's in Score for Website Users: A Data-driven Long-term Study on Risk-based Authentication Characteristics