On the usability of authentication security communication
Creators: name: Amft, Sabrina Michaela
Publisher: name: Hannover : Institutionelles Repositorium der Leibniz Universität Hannover
Year: 2024
Subjects: subject: Usable Security
subject: Authentication
subject: Open Source
subject: Security Measures
subject: contains research data
subject: Benutzbare IT-Sicherheit
subject: Authentifizierung
subject: Sicherheitsmaßnahmen
subject: enthält Forschungsdaten
subject: Dewey Decimal Classification::000 | Allgemeines, Wissenschaft::000 | Informatik, Wissen, Systeme::004 | Informatik

description: Information technology has become more and more ubiquitous in recent times, and it affects almost all aspects of modern life. To protect this technology and its underlying resources, the relevance of computer security has increased as well. However, the past has shown that in many regards, computer security not only depends on secure software and strong cryptography, but is also highly influenced by how humans interact with it. Therefore, usable security and privacy has emerged as a novel research area. It ex- amines how users understand security tooling and measures, and how they interact with them. Furthermore, its main goal is to improve security and related processes to make them easy to understand or use even for novices. In consequence, communication of security risks and potential mitigations is a major factor of usable security. In this thesis, I examine how security is communicated in different areas and between different stakeholders, with the overarching goal of evaluating in which ways communication can be improved, and what consequences a lack of communication can have. In my presented research, I evaluate the usability of authentication measures as a prime example of security measures that are both highly relevant for every type of users, and highly damaging when security is breached. Therefore, I present three peer-reviewed papers in this thesis: In the first, I investigate the setup process of password managers, a tedious task in which users ideally add all passwords at once, while updating them to stronger alternatives. I examine both the onboarding features that password managers provide, and survey end users to inquire how they handled the task of setting up their password managers. In the second work, I examine the communication of multi-factor authentication, especially regarding its recovery after the additional factors become inaccessible. Therefore, I collected authentication and recovery methods mentioned on websites, and conduct a user experience study to gauge whether the described processes are accurate. In the final one, I examine an expert cohort by conducting interviews with open- source contributors, asking them about their individual security measures, such as usage of password managers, and how individual security is communicated to and between contributors. Overall, I find that communication is lacking in various areas: In my research, service providers failed to clearly communicate their policies by either not providing guidance or not updating it, leading to a confusing status quo and insecure decision-making. In other areas, developers preferred to not communicate their security measures and best practices, leading to a volatile environment of unspoken expectations. The results of my research suggest that a more precise and clear communication of both risks and their mitigations can achieve a higher understanding, and in consequence, adoption of security measures. What needs to be communicated or enforced to reach people and increase their authentication security varies, however, with more research and diligence, these challenges can be overcome.