Mitigating Users' Misconceptions About FIDO2 Biometric Webauthn
Total Page：16
File Type：pdf, Size：1020Kb
“It’s Stored, Hopefully, on an Encrypted Server”: Mitigating Users’ Misconceptions About FIDO2 Biometric WebAuthn Leona Lassak, Annika Hildebrandt†, Maximilian Golla?, Blase Ur† Ruhr University Bochum, † University of Chicago, ? Max Planck Institute for Security and Privacy Abstract While prior attempts at passwordless authentication on the web have required specialized hardware, FIDO2’s WebAuthn protocol lets users sign into websites with their smartphone. Users authenticate locally via the phone’s unlock mechanism. Their phone then uses public-key cryptography to authenti- cate to the website. Using biometrics (e.g., fingerprint, face) for this local authentication can be convenient, yet may en- gender misconceptions that discourage adoption. Through three complementary studies, we characterized and sought to mitigate misconceptions about biometric WebAuthn. We (a) WebAuthn notification used (b) WebAuthn instructions on also compared it to non-biometric WebAuthn and traditional by eBay (June 2021, edited). a Google Pixel 3a (Android 11). passwords. First, 42 crowdworkers used biometric WebAuthn Figure 1: Examples of a site-specific notification used by to sign into a website and then completed surveys. Critically, eBay and OS-specific instructions for authenticating. 67% of participants incorrectly thought their biometrics were sent to the website, creating security concerns. In remote focus groups, 27 crowdworkers then co-designed short no- A user can also adopt a password manager to facilitate unique tifications to mitigate biometric WebAuthn misconceptions. passwords [45]. Sadly, adoption rates for these mechanisms Through a 345-participant online study, we found that some remain low [37, 45] and industry has thus continued to search notifications improved perceptions of biometric WebAuthn for an alternative to passwords for signing into websites [26]. and partially addressed misconceptions, yet key misconcep- One of the most promising approaches for passwordless tions about where the biometric is stored partially persisted. web authentication is the FIDO2 Project [5] and its web au- Nonetheless, participants were willing to adopt biometric thentication (WebAuthn) protocol. The core idea is to use WebAuthn over non-biometric WebAuthn or passwords. Our public-key cryptography in place of a password. To regis- work identifies directions for increasing the adoption of bio- ter with a website, the user’s authenticator (hardware token metric WebAuthn by highlighting its security and usability. or other device) creates a public-private keypair unique to that website. Subsequent authentication attempts proceed via 1 Introduction a challenge-response protocol, overcoming many disadvan- tages of passwords and also stopping phishing attacks [32]. Despite their drawbacks, passwords remain widely used. A Hardware tokens (e.g., YubiKeys) are commonly used as typical user can have hundreds of password-protected on- authenticators [5]. Recent user studies have demonstrated line accounts [44, 59]. To be secure, the user must create that using WebAuthn with a hardware security key achieves (and remember) a unique password for each service. If they substantial benefits relative to passwords in both security and reuse passwords across services, they are vulnerable to cre- usability [18,32]. The cost and inconvenience of security keys, dential stuffing attacks, in which attackers exploit credentials however, are impediments to widespread adoption [18, 32]. breached from one service to attack accounts on other ser- Fortunately, smartphones can also be used as FIDO2 au- vices where the user has a similar password [23, 43]. In thenticators. Smartphones’ ubiquity and familiarity to users response, online services have introduced two-factor authen- makes this support a crucial advance beyond prior attempts at tication (2FA)[11, 51] and risk-based authentication [22, 62]. passwordless online authentication. The private key is stored in a trusted enclave on the smartphone. The user authorizes encounter extrapolates about its properties. Thus, in Study 1, each use of the private key via their usual mechanism for 42 crowdworkers used biometric WebAuthn on an Android unlocking their phone. This unlock mechanism ultimately is phone to register and later authenticate at a website we con- a PIN, pattern, or password. However, schemes like Apple’s trolled. To understand participants’ preconceived notions, we Touch ID [9] and its Android equivalent enable users to un- intentionally gave little information about how WebAuthn lock their phone with a biometric, such as a fingerprint or face. worked. Through surveys, we investigated how participants As a result, these biometrics can also be used to sign into a thought biometric WebAuthn worked and explored potential website [5], an interaction we term biometric WebAuthn. misconceptions suggested by either the literature or Web- This ability to authenticate to websites using only a fin- Authn’s design. Critically, 67% of participants incorrectly gerprint or other biometric holds great promise. Because of thought their biometrics were sent to our website or elsewhere WebAuthn’s basis in public-key cryptography, it is far more outside their phone, leading to other misconceptions. secure than a password. Similar to how support for biometrics To help mitigate misconceptions we observed, especially made phone unlocking much more convenient [7,14,63], bio- those that might discourage adoption, we then focused on metric WebAuthn promises better usability than passwords. the design of short notifications that websites can display. Furthermore, support for WebAuthn is quickly being added by For example, Figure 1a shows eBay’s current notification. major websites, including eBay, Microsoft, and Yahoo [40]. Designing any notification that conveys complex technical Unfortunately, when biometric phone unlocking was intro- concepts in a short and simple format is a challenge in many duced, misconceptions were initially widespread [7,14,63], areas of security [21]. To this end, Study 2 engaged 27 par- and we hypothesized the same would hold true for biometric ticipants in seven online focus groups. After a moderator WebAuthn. The superficial appearance that a user is signing taught participants how biometric WebAuthn worked and the into an online service with only their fingerprint or face sug- group discussed their perceptions of WebAuthn, participants gests the potential for even more problematic misconceptions engaged in iterative co-design of new notifications. We dis- about biometric WebAuthn’s security and usability. These tilled participants’ ideas into six potential notifications. To misconceptions could discourage the adoption of biometric align notifications with what users would actually want to WebAuthn. Thus, our research focused on users’ initial en- learn, our co-design focus groups took an unrealistically large counters with biometric WebAuthn and their resultant expecta- amount of time to help non-technical users better understand tions. We anticipate that many users will encounter biometric how biometric WebAuthn works. They then collaboratively WebAuthn for the first time via a small notification on a web- proposed new notifications. This co-design approach, which site encouraging them to adopt the technology. Such short aims to benefit from end-users’ creativity and opinions [39], notifications cannot possibly capture FIDO2’s technical com- was motivated by prior research in which notifications for plexities. However, after looking at such a notification for 2FA, TLS, cryptographic APIs, and phishing prevention ben- a few seconds, many users will form expectations about the efited from similar focus groups [4, 25, 49, 60]. scheme’s security and usability, ultimately deciding whether Finally, Study 3 compared these notifications inspired by to adopt biometric WebAuthn based on very little information. our co-design focus groups. Each of 345 crowdworkers was While future work should examine how to better educate users assigned to use biometric WebAuthn (with one of those noti- about how FIDO2 actually works, we focused on understand- fications), non-biometric WebAuthn, or a site-specific pass- ing and improving these initial impressions and perceptions. word. Similar to Study 1, participants created an account We thus conducted three complementary user studies to on our website and answered survey questions. One notifi- understand and mitigate misconceptions about biometric Web- cation was a baseline representing how early-adopter com- Authn, as well as to compare it to non-biometric WebAuthn panies currently advertise WebAuthn. Relative to this base- (e.g., using a PIN) and site-specific passwords.1 For all stud- line, some notifications created through co-design improved ies, we did not expect participants to have any prior knowl- perceptions of biometric WebAuthn’s security and partially edge of biometric WebAuthn or how it worked. Rather, our addressed some key misconceptions. Furthermore, most par- intention was to understand their initial expectations relating ticipants were willing to adopt biometric WebAuthn over non- to security, privacy, usability, and trust. Study 1 and 3 were biometric WebAuthn and passwords for trustworthy websites. conducted on participants’ personal Android phones, which Nonetheless, many participants still held key misconceptions, was the most common, fully supported FIDO2 configuration especially about where their biometric is stored, highlighting at the time of the study [20]. While we focused on