Two-factor authentication (2F) aims to enhance resilience of password-based authentication by requiring users to provide an additional authentication factor, e.g., a code generated by a security token. However, it also introduces non-negligible costs for service providers and requires users to carry out additional actions during the authentication process. In this paper, we present an exploratory comparative study of the usability of 2F technologies. First, we conduct a pre-study interview to identify popular technologies as well as contexts and motivations in which they are used. We then present the results of a quantitative study based on a survey completed by 219 Mechanical Turk users, aiming to measure the usability of three popular 2F solutions: codes generated by security tokens, one-time PINs received via email or SMS, and dedicated smartphone apps (e.g., Google Authenticator). We record contexts and motivations, and study their impact on perceived usability. We find that 2F technologies are overall perceived as usable, regardless of motivation and or context of use. We also present an exploratory factor analysis, highlighting that three metrics -- ease-of-use, required cognitive efforts, and trustworthiness -- are enough to capture key factors affecting 2F usability.
Previous work has suggested that security via 2F decreases usability of end-user authentication. For instance, @cite_4 showed that 2F increases redundancy'', thus augmenting security but decreasing usability. Along similar lines, @cite_13 analyzed the effects of implementing 2F on productivity, focusing on the Common Access Card'' (CaC), a combined smart card photo ID card used (at that time) by US Department of Defense (DoD) employees. They reported that users stopped checking emails at home (due to the unavailability of card readers) and that many employees accidentally left their card in the reader. Authors also estimated that the DoD spent about @math 62 @math 22 @math 30 @math 141 @math 30$ proposed questions. The authors concluded that familiarity with a technology (rather than perceived usability) impacted user willingness to use a given authentication technology. Their results showed that users perceived the 1-factor method (with which the average user had most experience) as being the most secure and most convenient option.
@cite_13 @cite_4
2121371744 2072694646
The Department of Defense has mandated the use of a two-factor security system for access and authentication. The increased security of such a system has been extensively researched by the military. This research uses a survey to examine the effects on productivity and usability of implementing such a system. The usability of security systems has become a major issue in research on the efficiency and user acceptance of security systems. The authentication process is essential for controlling the access to various resources and facilities. The design of usable yet secure user authentication methods raises crucial questions concerning how to solve conflicts between security and usability goals.