On Risk-Based Authentication

guest · Oct 5, 2020

On Risk-Based Authentication
October 5, 2020
https://www.schneier.com/blog/archives/2020/10/on-risk-based-authentication.html

Interesting usability study: “More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication“:

Abstract: Risk-based Authentication (RBA) is an adaptive security measure to strengthen password-based authentication. RBA monitors additional features during login, and when observed feature values differ significantly from previously seen ones, users have to provide additional authentication factors such as a verification code. RBA has the potential to offer more usable authentication, but the usability and the security perceptions of RBA are not studied well.

We present the results of a between-group lab study (n=65) to evaluate usability and security perceptions of two RBA variants, one 2FA variant, and password-only authentication. Our study shows with significant results that RBA is considered to be more usable than the studied 2FA variants, while it is perceived as more secure than password-only authentication in general and comparably se-cure to 2FA in a variety of application types. We also observed RBA usability problems and provide recommendations for mitigation.

Our contribution provides a first deeper understanding of the users’perception of RBA and helps to improve RBA implementations for a broader user acceptance.
Click to expand...

Paper’s website. I’ve blogged about risk-based authentication before.
Click to expand...

Study: "More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication“
(PDF - 1.89 MB): https://riskbasedauthentication.org/download/rba-perceptions-paper.pdf

Log in or Sign up

On Risk-Based Authentication

guest Guest

Log in or Sign up

On Risk-Based Authentication

guest Guest

Useful Searches