Best Paper Award for Study on Smartphone Authentication

The award went to the paper “FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones”, in which the researchers tested and compared the acceptance and user-friendliness of two authentication methods in a study. Both methods have been supported by modern Android and Apple smartphones for several years, but although they are a secure alternative to passwords, they are still hardly used.

The two methods examined differ considerably: Instead of passwords, the login for “Platform Authentication” works via fingerprint and for “Roaming Authentication” with an external token that is held to the smartphone. The FIDO2 protocol developed by the Fast Identity Online Alliance runs in the background.

The study has now shown that although users would generally be willing to switch to passwordless authentication, it also depends on the type and properties of the specific account. The study participants mentioned here, for example, the frequency of use and the sensitivity of an account.

The strengths and weaknesses of FIDO2

While the great advantage of Platform Authentication by fingerprint is that you always have your finger ready and logging in is quick and easy, the disadvantage of this method for the study participants was that it cannot be easily extended to other devices. The smartphone stores a local key that is required for the login. This is not a problem with Roaming Authentication using NFC tokens, because the key is stored in the token. This has the advantage that the procedure can also be used on other end devices such as laptops. However, the disadvantage is already apparent here: the token can be lost, broken or even stolen. The thief would then have access to the accounts. In addition, the method is less practical because you have to remember to carry the token with you and, unlike fingerprints, it costs money.

With both methods, the question arose for the study participants as to what happens if one loses either the smartphone or the external key. How do you get back into your account? And how can online services be informed that access has been lost and the account blocked as a precaution?

For both procedures, the study participants were faced with the question of what happens if either the smartphone or the external key is lost. How do you get back into the account? And how can online services be informed that access has been lost and that the account should be blocked for security reasons?

Overall, the study was able to show which open problems should be addressed in authentication with FIDO2 and thus makes an important contribution to improving digital security among the population. This is because the two new authentication methods protect users against many attacks that have been used to steal passwords in the past. However, it is not enough to develop a technically secure procedure; it must also be usable in everyday life in order to be accepted.

Open Source Research

It is also special that the researchers open source their research data as well as the source code of the sample website used in the study to best support further research. The study was conducted in collaboration of the research areas seemoo and PEASEC, the LOEWE Center emergenCITY and the research project Open6GHub.