Evaluating smartphone-based dynamic security questions for fallback authentication: a field study

Yusuf Albayram,Mohammad Maifi Hasan Khan

doi:10.1186/s13673-016-0072-3

Yusuf Albayram, Mohammad Maifi Hasan Khan

Open Access

https://doi.org/10.1186/s13673-016-0072-3

Copy DOI

Abstract

AbstractTo address the limitations of static challenge question based fallback authentication mechanisms (e.g., easy predictability), recently, smartphone based autobiographical authentication mechanisms have been explored where challenge questions are not predetermined and are instead generated dynamically based on users’ day-to-day activities captured by smartphones. However, as answering different types and styles of questions is likely to require different amounts of cognitive effort and affect users’ performance, a thorough study is required to investigate the effect of type and style of challenge questions and answer selection mechanisms on users’ recall performance and usability of such systems. Towards that, this paper explores seven different types of challenge questions where different types of questions are generated based on users’ smartphone usage data. For evaluation, we conducted a field study for a period of 30 days with 24 participants who were recruited in pairs to simulate different kinds of adversaries (e.g., close friends, significant others). Our findings suggest that the question types do have a significant effect on user performance. Furthermore, to address the variations in users’ accuracy across multiple sessions and question types, we investigate and present a Bayesian classifier based authentication algorithm that can authenticate legitimate users with high accuracy by leveraging individual response patterns.

Highlights

While password based schemes are prevalent forms of authentication, as the number and complexity of passwords continue to grow due to the increasing number of online accounts per user and complicated password creation policies, users are finding it increasingly difficult to manage and remember passwords for different accounts, and have to reset passwords frequently [1, 2]
While a limited number of prior efforts looked into the possibility of using dynamic security questions for fallback authentication, they only looked at a limited number of question types [9,10,11], making it hard to judge the strengths and weaknesses of this approach considering different kinds of users, question types, and answer selection schemes. To complement these prior efforts and examine the effect of different types of security questions on different categories of users’ recall/guessability performance, this paper explores the design space of dynamic security questions that are generated using users’ day-to-day activities captured by smartphones
This paper makes the following key contributions: 1. First, we present the first study that compares the usability of seven different dynamic security question types, namely, call, SMS, location, application usage, music, physical activity, and battery charging events, which are generated based on users’ smartphone usage behavior and day-to-day activities captured by smartphones

Summary

Introduction

While password based schemes are prevalent forms of authentication, as the number and complexity of passwords continue to grow due to the increasing number of online accounts per user and complicated password creation policies, users are finding it increasingly difficult to manage and remember passwords for different accounts, and have to reset passwords frequently [1, 2]. Prior efforts investigated various forms of fallback authentication mechanisms to facilitate resetting of passwords. Pre-selected challenge questions (i.e., personal knowledge questions) are often used as a fallback authentication mechanism to facilitate resetting/recovery of passwords [3]. This widely used approach of leveraging static challenge questions as fallback authentication mechanism has several limitations. Static security questions are becoming weaker due to improved information retrieval techniques and increases in online content [8], where an attacker can obtain the answers to many of the static challenge questions by mining online sources (e.g., social networking sites, public records or even a simple Google search)

Methods

Results

Discussion

Conclusion