The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
Open accessAbstract
We evaluate two decades of proposals to replace text passwords for general-purpose user authentication on the web using a broad set of twenty-five usability, deployability and security benefits that an ideal scheme might provide. The scope of proposals we survey is also extensive, including password management software, federated login protocols, graphical password schemes, cognitive authentication schemes, one-time passwords, hardware tokens, phone-aided schemes and biometrics. Our comprehensive approach leads to key insights about the difficulty of replacing passwords. Not only does no known scheme come close to providing all desired benefits: none even retains the full set of benefits that legacy passwords already provide. In particular, there is a wide range from schemes offering minor security benefits beyond legacy passwords, to those offering significant security benefits in return for being more costly to deploy or more difficult to use. We conclude that many academic proposals have failed to gain traction because researchers rarely consider a sufficiently wide range of real-world constraints. Beyond our analysis of current schemes, our framework provides an evaluation methodology and benchmark for future web authentication proposals.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
None of the alternatives to text-based passwords has achieved replacing passwords until today because none improved security while offering the same deployability and usability as passwords.
“But none of the alternatives has achieved this goal until today [1], [2], since none of them could improve security while at the same time offering the same level of deployability and usability as passwords.”
From Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication (2020) · cites this paper as [1]
FIDO2 with a Yubico Security Key as an authenticator scores almost perfectly in Bonneau et al.'s framework, missing Nothing-to-Carry, Easy-Recovery-from-Loss, Server-Compatible, and Resilience-to-Theft.
“FIDO2 with a Yubico Security Key as an authenticator scores almost perfectly in the framework by Bonneau et al. [1], missing Nothing-to-Carry , Easy-Recovery-from-Loss , Server-Compatible , and Resilience-to-Theft .”
From Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication (2020) · cites this paper as [1]
Text-based passwords cannot satisfy Memorywise-Effortless and Scalable-for-Users.
“However, the two aspects of usability that text-based passwords cannot satisfy Memorywise-Effortless and Scalable-for-Users -are particularly important”
From Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication (2020) · cites this paper as [1]
FIDO2 provides credentials that cannot be phished, replayed, nor are subject to server breaches.
“it provides credentials that cannot be phished, replayed, nor are they subject to server breaches”
From Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication (2020) · cites this paper as [1]
In the authors' expert assessment, none of the existing alternatives to text-based passwords offers as many benefits in Bonneau et al.'s framework as FIDO2 with single-factor authentication.
“In fact, in our expert assessment, none of the existing alternatives to textbased passwords offers as many benefits in Bonneau's et al. framework as FIDO2 with single-factor authentication.”
From Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication (2020) · cites this paper as [1]
Cites
Password authentication with insecure communication
Lamport, L. (1981) · Communications of the ACM · doi:10.1145/358790.358797 · Cited by 2,789 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
SoK: SSL and HTTPS: Revisiting Past Challenges and Evaluating Certificate Trust Model Enhancements
Clark, J., & van Oorschot, P. C. (2013) · 2013 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2013.41 · Cited by 224 · see citing works
Egelman, S., Jain, S., Portnoff, R. S., Liao, K., Consolvo, S., & Wagner, D. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660273 · Cited by 134 · see citing works
Ghorbani Lyastani, S., Schilling, M., Neumayr, M., Backes, M., & Bugiel, S. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00047 · Cited by 108 · see citing works
A Tale of Two Studies: The Best and Worst of YubiKey Usability
Reynolds, J., Smith, T., Reese, K., Dickinson, L., Ruoti, S., & Seamons, K. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00067 · Cited by 73 · see citing works
An Extensive Formal Analysis of Multi-factor Authentication Protocols
Jacomme, C., & Kremer, S. (2021) · ACM Transactions on Privacy and Security · doi:10.1145/3440712 · Cited by 51 · see citing works
UniPass: design and evaluation of a smart device-based password manager for visually impaired users
Barbosa, N. M., Hayes, J., & Wang, Y. (2016) · Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing · doi:10.1145/2971648.2971722 · Cited by 40 · see citing works
FIDO Gets Verified: A Formal Analysis of the Universal Authentication Framework Protocol
Feng, H., Guan, J., Li, H., Pan, X., & Zhao, Z. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3217259 · Cited by 13 · see citing works
Pico in the Wild: Replacing Passwords, One Site at a Time
Aebischer, S., Dettoni, C., Jenkinson, G., Krol, K., Llewellyn-Jones, D., Masui, T., & Stajano, F. (2017) · Proceedings 2nd European Workshop on Usable Security · doi:10.14722/eurousec.2017.23017 · Cited by 6 · see citing works
Self-citation
- Authors
- Bonneau, J., Herley, C., Oorschot, P. C. V., & Stajano, F.
- Affiliations
- University of Cambridge (GB)
- Microsoft (United States) (US)
- Carleton University (CA)
- Venue
- 2012 IEEE Symposium on Security and Privacy
- Publisher
- IEEE
- Published
- 2012-05
- Pages
- 553-567
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2030112111
- Cited by
- 1,110
- References
- 1
- Citations by year
- 2026: 79 · 2025: 84 · 2024: 67 · 2023: 77 · 2022: 76 · 2021: 83 · 2020: 82 · 2019: 80 · 2018: 93 · 2017: 79 · 2016: 81 · 2015: 95 · 2014: 68 · 2013: 57 · 2012: 9
- FWCI
- 56.80
- Type
- conference paper
- Language
- en
- Open access
- green
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Apollo (University of Cambridge) (submittedVersion)
- Apollo
- Funders
- Canada Research Chairs
- Gates Cambridge Trust
- Natural Sciences and Engineering Research Council of Canada
- Topics
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- password replacement, web authentication, usability, deployability, security benefits, graphical passwords, one-time password, hardware tokens, biometrics
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
