To prevent password breaches and guessing attacks, banks increasingly turn to two-factor authentication (2FA), requiring users to present at least one more factor, such as a one-time password generated by a hardware token or received via SMS, besides a password. We can expect some solutions -- especially those adding a token -- to create extra work for users, but little research has investigated usability, user acceptance, and perceived security of deployed 2FA. This paper presents an in-depth study of 2FA usability with 21 UK online banking customers, 16 of whom had accounts with more than one bank. We collected a rich set of qualitative and quantitative data through two rounds of semi-structured interviews, and an authentication diary over an average of 11 days. Our participants reported a wide range of usability issues, especially with the use of hardware tokens, showing that the mental and physical workload involved shapes how they use online banking. Key targets for improvements are (i) the reduction in the number of authentication steps, and (ii) removing features that do not add any security but negatively affect the user experience.
Online banking. Just and Aspinall @cite_7 analysed the use of dual credential authentication for online banking from both security and usability points of view. They considered granularity and time of feedback given to users during the authentication steps as main usability properties, and found that some banks delayed feedback by not providing it at screen change, or provided granular feedback too late in the authentication process. They concluded that these issues are likely to confuse users, but did not conduct an actual user study. Our work complements @cite_7 as we conduct an in-depth user study aiming to understand authentication for online banking from the users' point of view. Also, while @cite_7 looked at dual credentials (e.g., two passwords, two PINs, or two challenge questions), we focus on actual 2FA.
@cite_7
1635927852
This paper presents the results of a security and usability review of the authentication implementations used by more than 10 UK banks. Our focus is on their use of dual text credentials that combine two passwords, PINs, or challenge questions (and some “partial selection” variations). We model the authentication protocols based upon several deployment choices, such as the credential rules, and use the model to compare the security and usability properties of the implementations. Our results indicate some variation and inconsistency across the UK banking industry, from which we offer some suggestions for improved authentication protocol design.