Authentication ceremonies detect and mitigate Man-in-the-Middle (MitM) attacks on end-to-end encrypted messengers, such as Signal, WhatsApp, or Threema. However, prior work found that adoption remains low as non-expert users have difficulties using them correctly. Anecdotal evidence suggests that security researchers also have trouble authenticating others. Since their issues are probably unrelated to user comprehension or usability, the root causes may lie deeper.
This work explores these root causes using autoethnography. The first author kept a five-month research diary of their experience with authentication ceremonies. The results uncover points of failure while planning and conducting authentication ceremonies. They include cognitive load, forgetfulness, social awkwardness, and explanations required by a communication partner. Additionally, this work identifies and discusses how sociocultural aspects affect authentication ceremonies. Lastly, this work discusses a design approach for cooperative security that employs cultural transcoding to improve sociocultural aspects of security by design.
History
Preferred Citation
Matthias Fassl and Katharina Krombholz. Why I Can't Authenticate --- Understanding the Low Adoption of Authentication Ceremonies with Autoethnography. In: International Conference on Human Factors in Computing Systems (CHI). 2023.
Primary Research Area
Empirical and Behavioral Security
Name of Conference
International Conference on Human Factors in Computing Systems (CHI)
Legacy Posted Date
2023-01-26
Open Access Type
Unknown
BibTeX
@inproceedings{cispa_all_3895,
title = "Why I Can't Authenticate --- Understanding the Low Adoption of Authentication Ceremonies with Autoethnography",
author = "Fassl, Matthias and Krombholz, Katharina",
booktitle="{International Conference on Human Factors in Computing Systems (CHI)}",
year="2023",
}