Abstract • Two/Multi-Factor Authentication (2FA/MFA) is becoming increasingly popular in academic institutions. • Prior Research examining how Students perceive 2FA has recommended it to be made mandatory, motivated by the fact that Students find it to be easy to use. Despite this, 2FA adoption remains low and the cause of its’ particularly high error rate lacks definitive answers. • This study interviews students who have found 2FA to be particularly frustrating to further understand how students are impacted by added measures and imagine futures where these limiting factors are removed. • Like other work, this study finds that 2FA adds time to the login process, disrupts the user’s main goal and incites fears over loss of access. • By eliciting detailed user experiences, this study finds that experiences that were detrimental to the usability and acceptability of 2FA were largely avoidable with greater user awareness (e.g. student picked unsuitable 2FA method and were not aware of alternatives). These findings highlight the need for greater communication regarding organisational security and how non-traditional channels may be the key to this.
Aims & Research Questions • This study aims to • Investigate how students perceive and experience 2FA at their University • Incorporate participatory design principles and processes to elicit design recommendations for a usable, tailored, 2FA system.
• Considering prior work has used quantitative methods, this study is concerned with eliciting detailed user to experiences to answer the following Research questions • How are Students Impacted by 2FA? • How do Students perceive 2FA? • What should a more thoughtful 2FA implementation look like?
Study Design Nine Frustrated Newcastle Students recruited
Participants were interviewed (using a semi structured approach)
Interviews Thematically analysed
• Recruitment • Prior to recruitment, the Researcher determined if Participants found University 2FA to be frustrating. This was done as those who were negatively impacted by 2FA were deemed to be more useful to answer the Research questions. • Recruitment strategy produced a more homogenous study population, which achieved data saturation with less participants • Interviews • Semi-structured interviews allowed a conversation between Researcher and Participant. Important for eliciting answers to an uncovered area of Research, where previously unthought of angles may appear mid-interview. • Thematic Analysis • Patterns identified in the data set using Thematic Analysis with an emergent approach.
Results • Interviews Thematically analysed, which produced 3 themes (and two subthemes) • Theme 1: Added Time • Users can become habituated to the task of inputting their password (syed et al, 2011) • 2FA feels like something built on top, makes elements of authentication systems more visible • Frustrating, but not time consuming. Leads to students living with issue
• Subtheme: How do Students Learn About 2FA? • Students not aware of options that were announced via email • Students learnt about 2FA and changed their behaviour when learning about 2FA socially
• Past personal use largely removed from the experience of providing 2nd factor regularly • Traditional channels (emails) not as effective as information learnt socially (Das et al, 2019)
Results (cont) • Theme 2: Disruption of Goal • Usability suffers when 2FA is viewed as a disruption (Colnago et al, 2018). • Two types of disruptions: 2FA disrupted productivity and 2FA disrupted tasks • Disruption of productivity: • Phone necessary and a distraction • Frustrating contentious relationship
• Disruption of Task • Participants unsure when they will need their second factor, sometimes led to abandoned sessions. Aligns with quantitative work (Reynolds et al, 2020) and explains 2FA high session abandonment (Abott & Patil, 2020). • 2FA was particularly disruptive when Participants could not complete the process quickly and easily ( which was often related to 2FA method).
Results (cont) • Theme 2 Subtheme: Security Awareness • Participants understood regularity of 2FA was for security, but without awareness to threats, it might be viewed as too stringent • University suffered recent cyber-attack, which made students more accepting • Increased awareness to risk appealed to Participant's sense of fear and efficacy. Motivated by technology adoption literature • Security is often intangible. Disruption users experience may mean Students associate 2FA as something antithetical to their interests, instead of something that protects them • Highlighting the need to continuously convince students added measures are needed and that 2FA protects them from risks while still being convenient to them
Results (cont) • Theme 3: Loss of Access • Lacking knowledge of what to do in the event they cannot provide their second factor, consequences of losing account access is of more immediate concern compared to the often-intangible threat 2FA is protecting them from
Conclusion • Despite being easy to use (Colnago et al, 2018), Students lack key information that can make for a more disruptive experience and incite fears over loss of access. Non-traditional communication channels may be more effective at relaying this information. • Greater awareness to risk makes added measures more acceptable, finding ways to communicate this is key. Could lead to further adoption elsewhere (Colnago et al, 2018). • Results are not generalisable, but aims to encourage Universities to consider the role communication plays in organisational security • Encourages further work to understand how security can be more prominent within Universities.