Journal of Cybersecurity, 2020, 1–15 doi: 10.1093/cybsec/tyaa010 Research Paper Research Paper Deploying authentication in the wild: towards greater ecological validity in security usability Downloaded from https://academic.oup.com/cybersecurity/article/6/1/tyaa010/5989371 by guest on 23 September 2021 studies Seb Aebischer,1 Claudio Dettoni,1 Graeme Jenkinson,1 Kat Krol,1 David Llewellyn-Jones,1 Toshiyuki Masui2,3 and Frank Stajano1,*,† 1Computer Laboratory, University of Cambridge, Cambridge, UK, 2Faculty of Science and Technology, Keio University Shonan Fujisawa Campus, Fujisawa, Kanagawa, Japan and 3Nota Inc., Japan *Correspondence address: Department of Computer Science and Technology, University of Cambridge, 15 JJ Thomson Avenue, Cambridge, CB3 0FD, UK. Tel: þ44-1223-763-500; E-mail:
[email protected] †Authors listed in alphabetical order. All authors contributed in some form to the Gyazo study while only authors S.A., C.D., K.K., D.L.-J. and F.S. contributed to the Innovate UK study. Author G.J. designed and coded the reverse proxy used in the Gyazo study but left the Pico project before the study started. Author T.M., inventor and CTO of Gyazo, visited the other authors in Cambridge several times for a total of 6 months in connection with the Gyazo study. Authors S.A., C.D., K.K. and D.L.-J. were at Cambridge while they carried out the research described in this article. The Principal Investigator was F.S. Received 8 March 2019; revised 24 January 2020; accepted 19 May 2020 Abstract Pico is a token-based login method that claims to be simultaneously more usable and more secure than passwords.