Knowledge-based authentication is the oldest and most widely used form of authentication, but it is still problematic. We present a model of the effects of usage cost variables (e.g., code length, required motion precisions) on authentication performance (time for authentication, error rate) and on the decision to use authentication. We tested model predictions in two experiments in which participants played an investment game and had to use authentication to change their investment. We manipulated the authentication method (personal identification number vs. graphical password), the required precision for authentication, the code length, and time pressure. The variables affected authentication decisions and performance, but the effects were not the same. Also, when the graphical password required greater response precision, performance and subjective ratings decreased dramatically, much more than predicted by combining the effects of the variables independently. These results point to a number of issues that must be considered when designing authentication procedures.
AdamsA.SasseM.A. (1999). Users are not the enemy: Why users compromise computer security mechanisms and how to take remedial measures. Communications of the ACM, 42, 41–46.
2.
AngeliD. A.CoventryL.JohnsonI. G.RenaudK. (2005). Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems. International Journal of Human–Computer Studies, 63, 128–152.
3.
Ben-AsherN.SiegerH.Ben-OvedA.KirschnickN.MeyerJ.MöllerS. (2011). On the need for different security methods on mobile phones. In Proceedings of the 13th International Conference on Human–Computer Interaction with Mobile Devices and Services (MobileHCI). (pp. 465–473). New York, NY: ACM.
4.
BesnardD.AriefB. (2004). Computer security impaired by legitimate users. Computers and Security, 23, 253–264.
5.
BiddleR.ChiassonS.van OorschotP.C. (2012). Graphical passwords: Learning from the first twelve years. ACM Computing Surveys, 44(4), Article No. 19.
6.
BillsA. G. (1934). General experimental psychology. New York, NY: Longmans, Green and Co.
ChiassonS.BiddleR.van OorschotP.C. (2007). A second look at the usability of click-based graphical passwords. In SOUPS ’07: Proceedings of the 3rd Symposium on Usable Privacy and Security (pp. 1–12). New York, NY: ACM.
9.
ChiassonS.ForgetA.StobertE.van OorschotP.C.BiddleR. (2009). Multiple password interference in text and click-based graphical passwords. In Proceedings of the 16th ACM Conference on Computer and Communications Security (pp. 500–511). New York, NY: ACM.
10.
ClarkeN.KaratzouniS.FurnellS. (2009). Flexible and transparent user authentication for mobile devices. In Emerging Challenges for Security, Privacy and Trust: The 24th International Information Security Conference, SEC 2009 (pp. 1–12). Berlin, Germany: Springer.
11.
DeDonnoA. M.DemareeA. H. (2008). Perceived time pressure and the Iowa Gambling Task. Judgment and Decision Making, 3, 636–640.
12.
De LucaA.LangheinrichM.HussmannH. (2010). Towards understanding ATM security: A field study of real world ATM use. In SOUPS ’10: Proceedings of the Sixth Symposium on Usable Privacy and Security (Article No. 16). New York, NY: ACM.
13.
DeWittA. J.KuljisJ. (2006). Is usable security an oxymoron?Interactions, 13(3), 41–44.
14.
DhamijaR.PerrigA. (2000). Déjà vu: A user study using images for authentication. In Proceedings of the 9th USENIX Security Symposium (pp. 45–58). Berkeley, CA: USENIX Association.
15.
EbertE. J. J. (2001). The role of cognitive resources in the valuation of near and far future events. Acta Psychology, 108, 155–171.
16.
GunsonN.MarshallD.MortonH.JackM. (2010). User perceptions of security and usability of single-factor and two-factor authentication in automated telephone banking. Computers & Security, 30, 208–220.
17.
HancockP. A.WarmJ. S. (1989). A dynamic model of stress and sustained attention. Human Factors, 31, 519–537.
18.
HuangD. L.RauP.-L. P.SalvendyG.GaoF.ZhouJ. (2011). Factors affecting perception of information security and their impacts on IT adoption and security practices. International Journal of Human–Computer Studies, 69, 870–883.
19.
InglesantP.SasseM. A. (2010). The true cost of unusable password policies: Password use in the wild. In CHI ’10: Proceedings of the 2010 SIGCHI Conference on Human Factors in Computing Systems (pp. 383–392). New York, NY: ACM.
20.
KahnemanD.TverskyA. (1979). Prospect theory: An analysis of decision under risk. Econometrica, 47, 263–291.
21.
KeithM.ShaoB.SteinbartP.J. (2007). The usability of passphrases for authentication: An empirical field study. International Journal of Human–Computer Studies, 65, 17–28.
22.
JainK. A.RossA.PrabhakarS. (2004). An introduction to biometric recognition. IEEE Transactions on Circuits and Systems for Video Technology, 14, 4–20.
23.
JermynI.MayerA.MonroseF.ReiterM. K.RubinA. D. (1999). The design and analysis of graphical passwords. In Proceedings of the 8th USENIX Security Symposium (pp. 1–14). Berkeley, CA: USENIX Association.
24.
KowalskiS.GoldsteinM. (2006, March). Consumers’ awareness of, attitudes towards and adoption of mobile phone security. Paper presented at the 20th International Symposium on Human Factors in Telecommunication: HTF, Sophia-Antipolis, France.
MonroseF.ReiterK.M. (2005). Graphical passwords. In CranorL. F.GarfinkelS. (Eds.), Security and usability: Designing secure systems that people can use (pp. 157–175). Sebastopol, CA: O’Reilly Media.
27.
MorrisR.ThompsonK. (1979). Password security: A case history. Communications of the ACM, 22, 594–597.
28.
NickersonR. S. (1965). Short-term memory for complex meaningful visual configurations: A demonstration of capacity. Canadian Journal of Psychology, 19, 155–160.
29.
NgB. Y.KankanhalliA.XuY. (2008). Studying users’ computer security behavior: A health belief perspective. Decision Support Systems, 46, 815–825.
30.
RenaudK. V. (2005). Evaluating authentication mechanisms. In CranorL.GarfinkelS. (Eds.), Security and usability: Designing secure systems that people can use (pp. 103–128). Sebastopol, CA: O’Reilly Media.
31.
SasamotoH.ChristinN.HayashiE. (2008). Undercover: Authentication usable in front of prying eyes. In Proceedings of the 26th Annual SIGCHI Conference on Human Factors in Computing Systems (pp. 183–192). New York, NY: ACM.
SasseM. A.FlechaisI. (2005). Usable security. In CranorL. F.GarfinkelS. (Eds.), Security and usability: Designing secure systems that people can use (pp. 13–30). Sebastopol, CA: O’Reilly Media.
34.
ShepardR. N. (1967). Recognition memory for words, sentences and pictures. Journal of Verbal Learning and Verbal Behavior, 6, 156–163.
StandingL.ConezioJ.HaberR. N. (1970). Perception and memory for pictures: Single-trial learning of 2500 visual stimuli. Psychonomic Science, 19, 73–74.
37.
VaccaJ. R. (2007). Practical Internet security. New York, NY: Springer.
38.
WegnerM. D.ErberR. (1992). The hyperaccessibility of thoughts. Journal of Personality and Social Psychology, 63, 903–912.
39.
WeinshallD.KirkpatrickS. (2004). Passwords you’ll never forget, but can’t recall. In Proceedings of CHI ’04 Extended Abstracts (pp. 1399–1402). New York, NY: ACM.
40.
WickensC. D. (1980). The structure of attentional resources. In NickersonR. (Ed.), Attention and performance VIII (pp. 239–257). Hillsdale, NJ: Lawrence Erlbaum.
41.
WickensC. D. (1984). Processing resources in attention. In ParasuramanR.DaviesD. R. (Eds.), Varieties of attention (pp. 63–102). New York, NY: Academic Press.
42.
WickensC. D. (2014). Effort in human factors performance and decision making. Human Factors, 56, 1329–1336.
43.
WiedenbeckS.WatersJ.BirgetJ. C.BrodskiyA.MemonN. (2005). PassPoints: Design and longitudinal evaluation of a graphical password system. International Journal of Human–Computer Studies, 63, 102–127.
