Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 17

The DOI matches its Crossref record; 29 of the 29 references it cites were found in a registry or an index.

FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones

Würsching, Leon, Putz, Florentin, Haesler, Steffen, Hollick, Matthias·2023·Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems
DOI 10.1145/3544548.3580993
Open this paper in CoChat — free account

Abstract

Modern smartphones support FIDO2 passwordless authentication using either external security keys or internal biometric authentication, but it is unclear whether users appreciate and accept these new forms of web authentication for their own accounts. We present the first lab study (N=87) comparing platform and roaming authentication on smartphones, determining the practical strengths and weaknesses of FIDO2 as perceived by users in a mobile scenario. Most participants were willing to adopt passwordless authentication during our in-person user study, but closer analysis shows that participants prioritize usability, security, and availability differently depending on the account type. We identify remaining adoption barriers that prevent FIDO2 from succeeding password authentication, such as missing support for contemporary usage patterns, including account delegation and usage on multiple clients.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3544548.3580993

Cites

29 of 29 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 29 references

Research works printed but not linked: 37

  1. Apple. 2022. iCloud Find My. https://www.apple.com/icloud/find-my. [Online; accessed 2022-06-07].
  2. Aaron Bangor Philip Kortum and James Miller. 2009. Determining What Individual SUS Scores Mean: Adding an Adjective Rating Scale. Journal of usability studies(2009).
  3. Yoav Benjamini and Yosef Hochberg. 1995. Controlling the False Discovery Rate: A Practical and Powerful Approach to Multiple Testing. Journal of the Royal Statistical Society: Series B (Methodological) (1995).
  4. John Brooke. 1996. SUS: A Quick and Dirty Usability Scale. Usability Evaluation in Industry(1996).
  5. Stéphane Ciolino, Simon Parkin, and Paul Dunphy. 2019. Of Two Minds about Two-Factor: Understanding Everyday FIDO U2F Usability through Device Comparison and Experience Sampling. In Fifteenth Symposium on Usable Privacy and Security (SOUPS).
  6. James Conners, Stephen Derbidge, Corey Devenport, Natalie Farnsworth, Kyler Gates, Stephen Lambert, Christopher McClain, Parker Nichols, and Daniel Zappala. 2022. Let’s Authenticate: Automated Certificates for User Authentication. In Network and Distributed Systems Security (NDSS) Symposium 2022.
  7. James Conners and Daniel Zappala. 2019. Let’s authenticate: Automated cryptographic authentication for the web with simple account recovery. In Who Are You?! Adventures in Authentication Workshop (WAY).
  8. Sanchari Das Andrew Kim Ben Jelen Joshua Streiff L Jean Camp and Lesa Huber. 2019. Towards Implementing Inclusive Authentication Technologies for Older Adults. In Who Are You?! Adventures in Authentication Workshop (WAY).
  9. Florian M. Farke, Lennart Lorenz, Theodor Schnitzler, Philipp Markert, and Markus Dürmuth. 2020. “You still use the password after all”–Exploring FIDO2 Security Keys in a Small Company. In Sixteenth Symposium on Usable Privacy and Security (SOUPS).
  10. Feitian. 2018. BioPass FIDO Series Biometric Security Keys. https://www.ftsafe.com/products/FIDO/BIO. [Online; accessed 2022-06-07].
  11. Feitian. 2020. iePass FIDO Series iOS Security Key. https://www.ftsafe.com/products/FIDO/iOS. [Online; accessed 2022-06-07].
  12. FIDO Alliance. 2017. FIDO U2F Raw Message Formats. https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-raw-message-formats-v1.2-ps-20170411.html. [Online; accessed 2022-06-07].
  13. FIDO Alliance. 2019. Android now FIDO2 certified, accelerating global migration beyond passwords. https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/. [Online; accessed 2022-06-07].
  14. FIDO Alliance. 2021. Client to Authenticator Protocol (CTAP). https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html. [Online; accessed 2022-06-07].
  15. FIDO Alliance. 2022. FIDO Alliance Member Companies & Organizations. https://fidoalliance.org/members/. [Online; accessed 2022-06-07].
  16. FIDO Alliance. 2022. FIDO Alliance Specifications Overview. https://fidoalliance.org/specifications/. [Online; accessed 2022-06-07].
  17. GoTrustID. 2022. Smart Badge Authenticator — Idem Card. https://www.gotrustid.com/idem-card. [Online; accessed 2022-06-07].
  18. Seunghun Han, Wook Shin, Jun-Hyeok Park, and HyoungChun Kim. 2018. A bad dream: Subverting trusted platform module while you are sleeping. In 27th USENIX Security Symposium.
  19. Juan Lang, Alexei Czeskis, Dirk Balfanz, Marius Schilder, and Sampath Srinivas. 2016. Security Keys: Practical Cryptographic Second Factors for the Modern Web. In International Conference on Financial Cryptography and Data Security.
  20. Leona Lassak, Annika Hildebrandt, Maximilian Golla, and Blase Ur. 2021. “It’s Stored, Hopefully, on an Encrypted Server”: Mitigating Users’ Misconceptions About FIDO2 Biometric WebAuthn. In 30th USENIX Security Symposium.
  21. Henry B. Mann and Donald R. Whitney. 1947. On a Test of Whether one of Two Random Variables is Stochastically Larger than the Other. The Annals of Mathematical Statistics 18 (1947).
  22. Nathan Mercer. 2018. Extending the capabilities of Windows Hello. https://techcommunity.microsoft.com/t5/windows-blog-archive/extending-the-capabilities-of-windows-hello/ba-p/166534. [Online; accessed 2022-06-07].
  23. Wataru Oogami, Hidehito Gomi, Shuji Yamaguchi, Shota Yamanaka, and Tatsuru Higurashi. 2020. Observation Study on Usability Challenges for Fingerprint Authentication Using WebAuthn-enabled Android Smartphones. In Sixteenth Symposium on Usable Privacy and Security (SOUPS).
  24. Kentrell Owens, Olabode Anise, Amanda Krauss, and Blase Ur. 2021. User Perceptions of the Usability and Security of Smartphones as FIDO2 Roaming Authenticators. In Seventeenth Symposium on Usable Privacy and Security (SOUPS).
  25. Kentrell Owens Blase Ur and Olabode Anise. 2020. A Framework for Evaluating the Usability and Security of Smartphones as FIDO2 Roaming Authenticators. In Who Are You?! Adventures in Authentication Workshop (WAY)).
  26. Florentin Putz, Steffen Schön, and Matthias Hollick. 2021. Future-Proof Web Authentication: Bring Your Own FIDO2 Extensions. In Emerging Technologies for Authorization and Authentication (ETAA). Springer.
  27. Brian Rasmussen. 2021. A Usability Study of FIDO2 Roaming Software Tokens as a Password Replacement. Master’s thesis. Brigham Young University.
  28. Ken Reese, Trevor Smith, Jonathan Dutson, Jonathan Armknecht, Jacob Cameron, and Kent Seamons. 2019. A Usability Study of Five Two-Factor Authentication Methods. In Fifteenth Symposium on Usable Privacy and Security (SOUPS).
  29. 10.5555/3489212.3489220 · doi:10.5555/3489212.3489220
  30. Statista. 2021. Market share of mobile operating systems in North America from January 2018 to June 2021. https://www.statista.com/statistics/1045192/share-of-mobile-operating-systems-in-north-america-by-month/. [Online; accessed 2022-06-07].
  31. Blase Ur, Fumiko Noma, Jonathan Bees, Sean M Segreti, Richard Shay, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2015. "I Added ’!’at the End to Make It Secure": Observing Password Creation in the Lab. In Eleventh Symposium On Usable Privacy and Security (SOUPS).
  32. Leon van den Boogaard. 2022. User understanding and user acceptance of biometric authentication on mobile phones. Master’s thesis. Radboud University.
  33. Jinke D. Van Der Laan, Adriaan Heino, and Dick De Waard. 1997. A Simple Procedure for the Assessment of Acceptance of Advanced Transport Telematics. Transportation Research Part C: Emerging Technologies (1997).
  34. Yubico. 2019. Yubico Launches the World’s First Lightning-Compatible Security Key the YubiKey 5Ci. https://www.yubico.com/press-releases/yubico-launches-the-worlds-first-lightning-compatible-security-key-the-yubikey-5ci/. [Online; accessed 2022-06-07].
  35. Yubico. 2022. Security Key NFC. https://www.yubico.com/us/product/security-key-nfc-by-yubico/. [Online; accessed 2022-06-07].
  36. Yubico. 2022. YubiKey 5C NFC. https://www.yubico.com/us/product/yubikey-5c-nfc/. [Online; accessed 2022-06-07].
  37. Yubico. 2022. YubiKey Bio - FIDO Edition. https://www.yubico.com/us/product/yubikey-bio/. [Online; accessed 2022-06-07].

Cited by

Metadata

Authors
Würsching, L., Putz, F., Haesler, S., & Hollick, M.
Affiliations
  • Secure Mobile Networking Lab (SEEMOO), Technische Universität Darmstadt, Germany
  • Science and Technology for Peace and Security (PEASEC), Technische Universität Darmstadt, Germany
ORCID
Venue
Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems
Publisher
ACM
Published
2023-04-19
Pages
1-16
DOI
10.1145/3544548.3580993
Cited by
17
References
29
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.