"They brought in the horrible key ring thing!" Analysing the Usability of Two-Factor Authentication in UK Online Banking

Abstract

To prevent password breaches and guessing attacks, banks increasingly turn to two-factor authentication (2FA), requiring users to present at least one more factor, such as a one-time password generated by a hardware token or received via SMS, besides a password. We can expect some solutionsespecially those adding a token -to create extra work for users, but little research has investigated usability, user acceptance, and perceived security of deployed 2FA. This paper presents an in-depth study of 2FA usability with 21 UK online banking customers, 16 of whom had accounts with more than one bank. We collected a rich set of qualitative and quantitative data through two rounds of semi-structured interviews, and an authentication diary over an average of 11 days. Our participants reported a wide range of usability issues, especially with the use of hardware tokens, showing that the mental and physical workload involved shapes how they use online banking. Key targets for improvements are (i) the reduction in the number of authentication steps, and (ii) removing features that do not add any security but negatively affect the user experience.

Responsibility and Tangible Security: Towards a Theory of User Acceptance of Security Tokens

“…We suggest that this was because token-based authentication, like 2FA, is more effortful, and deemed more worthwhile if required by the context, or if the user already has experience of a similar scheme. Our results are also consistent with Krol et al [21], whose participants worried about theft, and preferred the idea of biometric authentication. Participants also disliked the physical effort associated with having to interact with Pico.…”

“…Most used a hardware token only because their employer or bank forced them to. This is in line with Krol et al [21], who found that carrying and operating a hardware token for 2FA with online banking negatively correlated with satisfaction.…”

System usability scale evaluation of online banking services: A South African study

“…The number of online banking users has been growing throughout the world, as the convenience of using online banking to perform banking transactions throughout the day has an edge over previous delivery channels, mainly a visit to a brick-and-mortar bank branch. Nonetheless, online banking has problems that still need to be addressed to achieve the full benefits of the service, such as usability 3 and security 4 . Firstly, as much as adoption is increasing, the rate of adoption is not the same across different economies.…”

“…Although the findings were favourable in a prototype system, these cannot be generalised to a commercially developed system, as there are still major usability and privacy issues with biometric systems. Krol et al 3 reported on the usability of a two-factor authentication mechanism for online banking that used hardware tokens. The respondents from the study highlighted a preference for biometric authentication because of the high degree of mental and physical workload and usability issues of hardware tokens.…”

Demystifying Authentication Concepts in Smartphones: Ways and Types to Secure Access

“…According to a study by Zink and Waldvogel [82], 83.3% users considered that SMS-based transaction authentication number is not a usable solution. Another in-depth usability study by Krol et al [81] evaluated 2-factor authentication on 21 online banking customers (16 among 21 were having multiple accounts with more than one bank). Total 90 separate login sessions of all the participants were collected meticulously, over the period of 11 days.…”