Why I Can't Authenticate --- Understanding the Low Adoption of Authentication Ceremonies with Autoethnography

(2023) Why I Can't Authenticate --- Understanding the Low Adoption of Authentication Ceremonies with Autoethnography.

Text Why_I_Can_t_Authenticate__Understanding_the_Low_Adoption_of_Authentication_Ceremonies_with_Autoethnography__CHI_2023.pdf Download (2MB)

Abstract

Authentication ceremonies detect and mitigate Man-in-the-Middle (MitM) attacks on end-to-end encrypted messengers, such as Signal, WhatsApp, or Threema. However, prior work found that adoption remains low as non-expert users have difficulties using them correctly. Anecdotal evidence suggests that security researchers also have trouble authenticating others. Since their issues are probably unrelated to user comprehension or usability, the root causes may lie deeper. This work explores these root causes using autoethnography. The first author kept a five-month research diary of their experience with authentication ceremonies. The results uncover points of failure while planning and conducting authentication ceremonies. They include cognitive load, forgetfulness, social awkwardness, and explanations required by a communication partner. Additionally, this work identifies and discusses how sociocultural aspects affect authentication ceremonies. Lastly, this work discusses a design approach for cooperative security that employs cultural transcoding to improve sociocultural aspects of security by design.

Item Type:	Conference or Workshop Item (A Paper) (Paper)
Divisions:	Katharina Krombholz (Human-Oriented Security, HOS)
Conference:	CHI International Conference on Human Factors in Computing Systems
Depositing User:	Matthias Fassl
Date Deposited:	26 Jan 2023 13:52
Last Modified:	26 Jan 2023 13:52
Primary Research Area:	NRA5: Empirical & Behavioral Security
URI:	https://publications.cispa.saarland/id/eprint/3895

Actions

Actions (login required)

View Item