Exploring, Expanding and Evaluating Usable Security in Online Banking Sven Kiljan Copyright c 2017 Sven Kiljan ISBN: 978-94-6233-648-3 NUR: 965 Typeset using LATEX 2ε (MiKTEX) LATEX template by Pim Vullers (https://github.com/pimvullers/phd_thesis) Printed by Gildeprint (https://www.gildeprint.nl) This research is part of the Dutch Research Program on Safety and Security of Online Banking, also known by its Dutch title: Kennisprogramma Veiligheid Digitaal Betalingsverkeer (KVDB). The PhD program it hosted was coordinated by Open University of the Netherlands. The author of this thesis was employed at Open University of the Netherlands from September, 2015 to August, 2016. KVDB was funded by the Dutch banking sector (represented by the Dutch Banking Association) and the Dutch National Police (represented by the Police Academy of the Netherlands). The work on which this thesis is based was performed at NHL University of Applied Sciences and Radboud University. The author of this thesis was employed at NHL University of Applied Sciences from September, 2012 until August, 2015. This work is licensed under the Creative Commons Attribution-ShareAlike 4.0 International license. To view a copy of this license, please visit http://creativecommons.org/licenses/by-sa/4.0/. Exploring, Expanding and Evaluating Usable Security in Online Banking Proefschrift ter verkrijging van de graad van doctor aan de Open Universiteit op gezag van de rector magnificus prof. mr. A. Oskamp ten overstaan van een door het College voor promoties ingestelde commissie in het openbaar te verdedigen op vrijdag 9 juni 2017 te Heerlen om 10:30 precies door Sven Zdenjek Kiljan geboren op 2 oktober 1985 te Alkmaar Promotoren Prof. dr. M.C.J.D. (Marko) van Eekelen Open Universiteit Radboud Universiteit Prof. dr. W.Ph. (Wouter) Stol Open Universiteit Co-promotor Dr. ir. H.P.E. (Harald) Vranken Open Universiteit Radboud Universiteit Overige leden beoordelingscommissie Prof. dr. S. (Sjouke) Mauw Universiteit van Luxemburg Dr. K. (Karen) Renaud Universiteit van Glasgow, Verenigd Koninkrijk Prof. dr. G.C. (Gerrit) van der Veer Open Universiteit Vrije Universiteit Amsterdam Prof. dr. T.E.J. (Tanja) Vos Open Universiteit Deze scriptie is opgedragen aan mijn dierbare moeder. Preface vii Preface This thesis symbolizes the closure of a four year experience. All other parts of it are dedicated to the products of the research that was conducted in this period. Despite my name as the author of this book, each part has been thoroughly examined, adjusted, reviewed, and rewritten with the support of numerous people. Due to the high level of specialization, the fieldwork often feels like a lonely endeavor, but I was never alone. To explain my feelings in the purest way possible, this preface is written solely by me. Consider it a letter dedicated to everyone who contributed directly or indirectly to my work and the final result that is this thesis. First, let me thank all of you who I cannot refer to directly. Non-disclosure, limited space... Whatever the reason might be, know that I thought of you and that I appreciated the time and effort you spend to support my work. Professional support for my research came from the Dutch Research Program on Safety and Security of Online Banking (in Dutch: Kennisprogramma Veiligheid Digitaal Betalingsverkeer, KVDB). While the program financed the work, I consider my colleagues as the most valuable resource this program provided. It is rare to meet a group that is both witty and silly, knowledgeable and practical, independent and cooperative, and stubborn and supportive. For some, the day that they meet such people would be the most important day of their lives. But for me, it was Tuesday. Many Tuesdays, actually. On this day of the week, I often traveled to the NHL University of Applied Sciences where my direct colleagues within the research program conducted their work. A single trip by car took two hours, and some would consider it silly to spend so much time on the road to meet others of which their work does not fully align with their own. I can honestly say that I have never regretted any second of the journey to see my fellow researchers and close friends. Sanne Boes, Jurjen Jansen and Rutger Leukfeldt, I thank you for the many laughs and cries that we shared in our office at NHL. Mariëtte van Kuik, while the period we shared in the program was short, our time is not any less appreciated. Since I am now writing about NHL, there are those who were not part of the program but who cannot go unmentioned. Joyce, Marja, Renske, Sander, and all the others of lectoraat Cybersafety, to you I wish the best of luck with the new Cyber Science Center. Nicolien Kop, Evert Stamhuis, Wouter Stol, due to your shared efforts as initiat- ors, I was able to join a research program in which I could extend my knowledge and experience to an unimaginable degree. For this I thank you. I want to give a special mention to Marko van Eekelen. It is true that you are an initiator and supervisor of the program. It is also true that you carry the formal role of being my coordinating ix promotor. However, the most important truth is that you were the best daily super- visor a PhD could ask for. Many afternoons were spend in your office in which we talked, debated and even had heated arguments about the direction of the research, the methods to apply and the importance of the almost infinite aspects that we had to keep track of. I cannot say that we always fully agreed with each other, but do not consider that a negative point. The alternative views you gave me were a fuel source that recharged my motivation and inspiration. These are aspects which PhD candidates often struggle with over the years, but you gave me plenty whenever I was running on empty. I cannot thank you enough for this. Although formally not part of KVDB, I do consider my co-promotor Harald Vranken an essential part of the program. Where Marko guided my research from a higher level, you supplemented the lower level with indispensable in-depth tech- nical advice. Harald, do not consider your contribution and my gratitude any less compared to my other colleagues. Two other direct contributors to my work are Hugo Jonker (Open University of the Netherlands) and Rolando Trujillo Rasua (University of Luxembourg). They gave me insight in formal protocol analysis, a field that is not my own and which I touched briefly on while writing this thesis. Your willingness to examine my sugges- tions and to give good advice on how to model it in Scyther gave me a needed push in the right direction. Another contributor was Safet Acifovic, a former student of Radboud University. He assisted by formally verifying an earlier part of my work. Safet, thank you for your time spend with ProVerif to let Marko and me know what could be improved. I wish you good luck with your career. In addition, I would like to thank Sung-Shik Jongmans. Your investment in time to evaluate all those authentication methods is highly appreciated. There are also those who contributed indirectly to my work, but not any less significantly. To talk about them, I have to start from the beginning. The first day of my four year PhD course started on Monday 3 September 2012 at my daily workplace for my PhD program, which was in the Digital Security research group of Radboud University in Nijmegen. There I shared rooms and knowledge with some of the brightest minds in the area of technical and information security. Some of those worked directly for Radboud University while others were like me, guest researchers from Open University of the Netherlands. Wherever these fine folk came from, there are simply too many of them to thank by name. However, I cannot skip over a few important and honorable mentions. Let me start with Bernard van Gastel, with which I shared office rooms in different periods. The technical conversations we had will never be forgotten, and I am glad that I was able to introduce and partially convert you to Arch Linux. I hope it will serve you well. For a while I also shared rooms with some of the members of the Privacy & Identity Lab. The nature of my research never focused much on privacy, but this was very much compensated by the talks we had. Merel Koning and Michael Colesky, thank you for tolerating my presence every time I performed the role of the devil’s advocate. Time just flew by whenever we discussed something from the news or a potential new concept that popped in one of our minds, and it was time well spend. Never give up the good fight. Two of the most influential persons I met at Radboud University are Anna x Krasnova and Markus Klinik. Your characters and humor lifted up my spirit whenever I was feeling down, and this extended well beyond the work floor into my personal life. For me, our friendship is as valuable as close family bonds. It is why I invited each of you to fulfill the role of paranymph for my thesis defense, and I appreciate it deeply that we can share this day together. Whereas Anna and Markus touched my heart, someone else from Radboud Uni- versity managed to capture it. Manxia Liu, it was at the start of the third year of my research program that you changed my life, but only in good ways. You supported me throughout the second half of my PhD course as my friend and partner.