* Islam et al. (2023) Mazharul Islam, Marina Sanusi Bohuk, Paul Chung, Thomas Ristenpart, and Rahul Chatterjee. 2023.  $\\{$Araña$\\}$: Discovering and Characterizing Password Guessing Attacks in Practice. In _32nd USENIX Security Symposium (USENIX Security 23)_. 1019–1036.
  * Ivan Krstić (2023) Ivan Krstić. 2023.  _Personal Data in the Cloud Is Under Siege. End-to-End Encryption Is Our Most Powerful Defense._
  * Jana et al. (2020) Abhishek Jana, Md Kamruzzaman Sarker, Monireh Ebrahimi, Pascal Hitzler, and George T Amariucai. 2020.  Neural fuzzy extractors: A secure way to use artificial neural networks for biometric user authentication.  _arXiv preprint arXiv:2003.08433_ (2020).
  * Jangid et al. (2023) Mohit Kumar Jangid, Yue Zhang, and Zhiqiang Lin. 2023.  Extrapolating Formal Analysis to Uncover Attacks in Bluetooth Passkey Entry Pairing.. In _NDSS_.
  * Javed et al. (2014) Ashar Javed, David Bletgen, Florian Kohlar, Markus Dürmuth, and Jörg Schwenk. 2014.  Secure fallback authentication and the trusted friend attack. In _2014 IEEE 34th International Conference on Distributed Computing Systems Workshops (ICDCSW)_. IEEE, 22–28.
  * Jayakrishnan et al. (2020) Gokul Chettoor Jayakrishnan, Gangadhara Reddy Sirigireddy, Sukanya Vaddepalli, Vijayanand Banahatti, Sachin Premsukh Lodha, and Sankalp Suneel Pandit. 2020.  Passworld: A serious game to promote password awareness and diversity in an enterprise. In _Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020)_. 1–18.
  * Joanna Stern and Nicole Nguyen (2023) Joanna Stern and Nicole Nguyen. February 2023.  A Basic iPhone Feature Helps Criminals Steal Your Entire Digital Life.  https://www.wsj.com/tech/personal-tech/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a.
  * John Swanson (2022) John Swanson. December 2022.  _Raising the bar for software security: next steps for GitHub.com 2FA_.
  * Joudaki et al. (2018) Zeinab Joudaki, Julie Thorpe, and Miguel Vargas Martin. 2018.  Reinforcing system-assigned passphrases through implicit learning. In _Proceedings of the 2018 ACM SIGSAC conference on computer and communications security_. 1533–1548.
  * Jover (2020) Roger Piqueras Jover. 2020.  Security analysis of SMS as a second factor of authentication.  _Commun. ACM_ 63, 12 (2020), 46–52.
  * Just and Aspinall (2009) Mike Just and David Aspinall. 2009.  Personal choice and challenge questions: a security and usability assessment. In _Proceedings of the 5th Symposium on Usable Privacy and Security_. 1–11.
  * Kalantari et al. (2023) Shirin Kalantari, Pieter Philippaerts, Yana Dimova, Danny Hughes, Wouter Joosen, and Bart De Decker. 2023.  A User-Centric Approach to API Delegations: Enforcing Privacy Policies on OAuth Delegations. In _European Symposium on Research in Computer Security_. Springer, 318–337.
  * Karlson et al. (2009) Amy K Karlson, AJ Bernheim Brush, and Stuart Schechter. 2009.  Can I borrow your phone? Understanding concerns when sharing mobile phones. In _Proceedings of the SIGCHI Conference on Human Factors in Computing Systems_. 1647–1650.
  * Kashmir Hill (2022a) Kashmir Hill. 2022a.  _A Dad Took Photos of His Naked Toddler for the Doctor. Google Flagged Him as a Criminal._
  * Kashmir Hill (2022b) Kashmir Hill. 2022b.  _Her Child’s Naked Dance Killed Her Google Account. New Appeals Path Restored It._
  * Kashmir Hill (2023) Kashmir Hill. 2023.  _How Your Child’s Online Mistake Can Ruin Your Digital Life_.
  * Kassis and Hengartner (2023) Andre Kassis and Urs Hengartner. 2023.  Breaking Security-Critical Voice Authentication. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE, 951–968.
  * Katsini et al. (2018) Christina Katsini, Christos Fidas, George E Raptis, Marios Belk, George Samaras, and Nikolaos Avouris. 2018.  Influences of human cognition and visual behavior on password strength during picture password composition. In _Proceedings of the 2018 CHI conference on human factors in computing systems_. 1–14.
  * Kaye (2011) Joseph’Jofish’ Kaye. 2011.  Self-reported password sharing strategies. In _Proceedings of the SIGCHI Conference on Human Factors in Computing Systems_. 2619–2622.
  * Keil et al. (2022) Markus Keil, Philipp Markert, and Markus Dürmuth. 2022.  “It’s Just a Lot of Prerequisites”: A User Perception and Usability Analysis of the German ID Card as a FIDO2 Authenticator. In _Proceedings of the 2022 European Symposium on Usable Security_. 172–188.
  * Kelley et al. (2012) Patrick Gage Kelley, Saranga Komanduri, Michelle L Mazurek, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Julio Lopez. 2012.  Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. In _2012 IEEE symposium on security and privacy_. IEEE, 523–537.
  * Kepkowski et al. (2022) Michal Kepkowski, Lucjan Hanzlik, Ian Wood, and Mohamed Ali Kaafar. 2022.  How not to handle keys: Timing attacks on FIDO authenticator privacy.  _arXiv preprint arXiv:2205.08071_ (2022).
  * Kepkowski et al. (2023) Michal Kepkowski, Maciej Machulak, Ian Wood, and Dali Kaafar. 2023.  Challenges with Passwordless FIDO2 in an Enterprise Setting: A Usability Study. In _2023 IEEE Secure Development Conference (SecDev)_. IEEE, 37–48.
  * Khamis et al. (2019) Mohamed Khamis, Tobias Seitz, Leonhard Mertl, Alice Nguyen, Mario Schneller, and Zhe Li. 2019.  Passquerade: Improving error correction of text passwords on mobile devices by using graphic filters for password masking. In _Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems_. 1–8.
  * Kiesel et al. (2017) Johannes Kiesel, Benno Stein, and Stefan Lucks. 2017.  A Large-scale Analysis of the Mnemonic Password Advice.. In _NDSS_.
  * Kim et al. (2012) Hyoungshick Kim, John Tang, and Ross Anderson. 2012.  Social authentication: harder than it looks. In _International conference on financial cryptography and data security_. Springer, 1–15.
  * Kim Zetter (2008) Kim Zetter. 2008.  _Palin E-Mail hacker Says It Was Easy_.
  * Komen (2016) Leah Komen. 2016.  “Here you can use it”: Understanding mobile phone sharing and the concerns it elicits in rural Kenya.  _for (e) dialogue_ 1, 1 (2016), 52–65.
  * Koppel et al. (2016) Ross Koppel, Jim Blythe, Vijay Kothari, and Sean Smith. 2016.  Beliefs about cybersecurity rules and passwords: A comparison of two survey samples of cybersecurity professionals versus regular users. In _Twelfth Symposium on Usable Privacy and Security (SOUPS 2016)_.
  * Koushki et al. (2021) Masoud Mehrabi Koushki, Borke Obada-Obieh, Jun Ho Huh, and Konstantin Beznosov. 2021.  On smartphone users’ difficulty with understanding implicit authentication. In _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_. 1–14.
  * Kraus et al. (2021) Lydia Kraus, Mária Svidronová, and Elizabeth Stobert. 2021.  How do users chain email accounts together?. In _IFIP International Conference on ICT Systems Security and Privacy Protection_. Springer, 416–429.
  * Krombholz et al. (2017) Katharina Krombholz, Aljosha Judmayer, Matthias Gusenbauer, and Edgar Weippl. 2017.  The other side of the coin: User experiences with bitcoin security and privacy. In _Financial Cryptography and Data Security: 20th International Conference, FC 2016, Christ Church, Barbados, February 22–26, 2016, Revised Selected Papers 20_. Springer, 555–580.
  * Kroschewski and Lehmann (2023) Maximilian Kroschewski and Anja Lehmann. 2023.  Save The Implicit Flow? Enabling Privacy-Preserving RP Authentication in OpenID Connect.  _Proceedings on Privacy Enhancing Technologies_ (2023).
  * Kuchhal et al. (2023) Dhruv Kuchhal, Muhammad Saad, Adam Oest, and Frank Li. 2023.  Evaluating the Security Posture of Real-World FIDO2 Deployments. In _Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security_. 2381–2395.
  * Kunke et al. (2021) Johannes Kunke, Stephan Wiefling, Markus Ullmann, and Luigi Lo Iacono. 2021.  Evaluation of account recovery strategies with FIDO2-based passwordless authentication.  _arXiv preprint arXiv:2105.12477_ (2021).
  * Lai et al. (2017) Russell WF Lai, Christoph Egger, Dominique Schröder, and Sherman SM Chow. 2017.  Phoenix: Rebirth of a Cryptographic $\\{$Password-Hardening$\\}$ Service. In _26th USENIX Security Symposium (USENIX Security 17)_. 899–916.
  * Lain et al. (2022) Daniele Lain, Kari Kostiainen, and Srdjan Čapkun. 2022.  Phishing in organizations: Findings from a large-scale and long-term study. In _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 842–859.
  * Lassak et al. (2021) Leona Lassak, Annika Hildebrandt, Maximilian Golla, and Blase Ur. 2021.  ” It’s Stored, Hopefully, on an Encrypted Server”: Mitigating Users’ Misconceptions About $\\{$FIDO2$\\}$ Biometric $\\{$WebAuthn$\\}$. In _30th USENIX Security Symposium (USENIX Security 21)_. 91–108.
  * Lassak et al. (2024a) Leona Lassak, Philipp Markert, Maximilian Golla, Elizabeth Stobert, and Markus Dürmuth. 2024a.  A Comparative Long-Term Study of Fallback Authentication Schemes. In _Proceedings of the CHI Conference on Human Factors in Computing Systems_. 1–19.
  * Lassak et al. (2024b) Leona Lassak, Elleen Pan, Blase Ur, and Maximilian Golla. 2024b.  Why Aren’t We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication.  (2024).
  * Lee et al. (2019) Jaeho Lee, Ang Chen, and Dan S Wallach. 2019.  Total Recall: Persistence of Passwords in Android.. In _NDSS_.
  * Lee et al. (2020) Kevin Lee, Benjamin Kaiser, Jonathan Mayer, and Arvind Narayanan. 2020.  An empirical study of wireless carrier authentication for $\\{$SIM$\\}$ swaps. In _Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020)_. 61–79.
  * Lee and Narayanan (2021) Kevin Lee and Arvind Narayanan. 2021.  Security and privacy risks of number recycling at mobile carriers in the United States. In _2021 APWG Symposium on Electronic Crime Research (eCrime)_. IEEE, 1–17.
  * Lee et al. (2022) Kevin Lee, Sten Sjöberg, and Arvind Narayanan. 2022.  Password policies of most top websites fail to follow best practices. In _Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)_. 561–580.
  * Lei et al. (2023) Chongqing Lei, Zhen Ling, Yue Zhang, Kai Dong, Kaizheng Liu, Junzhou Luo, and Xinwen Fu. 2023.  Do Not Give a Dog Bread Every Time He Wags His Tail: Stealing Passwords through Content Queries (CONQUER) Attacks. In _The Network and Distributed System Security Symposium (NDSS)_. Internet Society.
  * Lei et al. (2021) Zeyu Lei, Yuhong Nan, Yanick Fratantonio, and Antonio Bianchi. 2021.  On the insecurity of SMS one-time password messages against local attackers in modern mobile devices. In _Network and Distributed Systems Security (NDSS) Symposium 2021_.
  * Lewis and Venkatasubramanian (2021) Brittany Lewis and Krishna Venkatasubramanian. 2021.  “I… Got my Nose-Print. But it Wasn’t Accurate”: How People with Upper Extremity Impairment Authenticate on their Personal Computing Devices. In _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_. 1–14.
  * Li et al. (2022) Changjiang Li, Li Wang, Shouling Ji, Xuhong Zhang, Zhaohan Xi, Shanqing Guo, and Ting Wang. 2022.  Seeing is living? rethinking the security of facial liveness verification in the deepfake era. In _31st USENIX Security Symposium (USENIX Security 22)_. 2673–2690.
  * Li et al. (2013) Lingjun Li, Xinxin Zhao, and Guoliang Xue. 2013.  Unobservable re-authentication for smartphones.. In _NDSS_ , Vol. 56. Citeseer, 57–59.
  * Li et al. (2015) Yan Li, Yingjiu Li, Qiang Yan, Hancong Kong, and Robert H Deng. 2015.  Seeing your face is not enough: An inertial sensor-based liveness detection for face authentication. In _Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security_. 1558–1569.
  * Li et al. (2018) Yue Li, Haining Wang, and Kun Sun. 2018.  Email as a master key: Analyzing account recovery in the wild. In _IEEE INFOCOM 2018-IEEE Conference on Computer Communications_. IEEE, 1646–1654.
  * Li et al. (2014a) Zhigong Li, Weili Han, and Wenyuan Xu. 2014a.  A $\\{$Large-Scale$\\}$ Empirical Analysis of Chinese Web Passwords. In _23rd USENIX Security Symposium (USENIX Security 14)_. 559–574.
  * Li et al. (2014b) Zhiwei Li, Warren He, Devdatta Akhawe, and Dawn Song. 2014b.  The $\\{$Emperor’s$\\}$ new password manager: Security analysis of web-based password managers. In _23rd USENIX Security Symposium (USENIX Security 14)_. 465–479.
  * Liang et al. (2021) Chen Liang, Chun Yu, Xiaoying Wei, Xuhai Xu, Yongquan Hu, Yuntao Wang, and Yuanchun Shi. 2021.  Auth+ track: Enabling authentication free interaction on smartphone by continuous user tracking. In _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_. 1–16.
  * Lin et al. (2021) Junchao Lin, Jason I Hong, and Laura Dabbish. 2021.  ” It’s our mutual responsibility to share” The Evolution of Account Sharing in Romantic Couples.  _Proceedings of the ACM on Human-Computer Interaction_ 5, CSCW1 (2021), 1–27.
  * Lin et al. (2022) Xu Lin, Panagiotis Ilia, Saumya Solanki, and Jason Polakis. 2022.  Phish in sheep’s clothing: Exploring the authentication pitfalls of browser fingerprinting. In _31st USENIX Security Symposium (USENIX Security 22)_. 1651–1668.
  * Liu et al. (2019) Enze Liu, Amanda Nakanishi, Maximilian Golla, David Cash, and Blase Ur. 2019.  Reasoning analytically about password-cracking software. In _2019 IEEE Symposium on Security and Privacy (SP)_. IEEE, 380–397.
  * Liu et al. (2017) Jian Liu, Chen Wang, Yingying Chen, and Nitesh Saxena. 2017.  VibWrite: Towards finger-input authentication on ubiquitous surfaces via physical vibration. In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_. 73–87.
  * Liu et al. (2023) Peiyuan Liu, Jeremiah Blocki, and Wenjie Bai. 2023.  Confident monte carlo: Rigorous analysis of guessing curves for probabilistic password models. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE, 626–644.
  * Lyastani et al. (2018) Sanam Ghorbani Lyastani, Michael Schilling, Sascha Fahl, Michael Backes, and Sven Bugiel. 2018.  Better managed than memorized? Studying the Impact of Managers on Password Strength and Reuse. In _27th USENIX Security Symposium (USENIX Security 18)_. 203–220.
  * Lyastani et al. (2020) Sanam Ghorbani Lyastani, Michael Schilling, Michaela Neumayr, Michael Backes, and Sven Bugiel. 2020.  Is fido2 the kingslayer of user authentication? a comparative usability study of fido2 passwordless authentication. In _2020 IEEE Symposium on Security and Privacy (SP)_. IEEE, 268–285.
  * Ma et al. (2014) Jerry Ma, Weining Yang, Min Luo, and Ninghui Li. 2014.  A study of probabilistic password models. In _2014 IEEE Symposium on Security and Privacy_. IEEE, 689–704.
  * Mainka et al. (2016) Christian Mainka, Vladislav Mladenov, and Jörg Schwenk. 2016.  Do not trust me: Using malicious IdPs for analyzing and attacking single sign-on. In _2016 IEEE European Symposium on Security and Privacy (EuroS &P)_. IEEE, 321–336.
  * Mainka et al. (2017) Christian Mainka, Vladislav Mladenov, Jörg Schwenk, and Tobias Wich. 2017.  SoK: single sign-on security—an evaluation of openID connect. In _2017 IEEE European Symposium on Security and Privacy (EuroS &P)_. IEEE, 251–266.
  * Mark Risher (2021) Mark Risher. May 2021.  A simpler and safer future — without passwords.  https://blog.google/technology/safety-security/a-simpler-and-safer-future-without-passwords/.  (May 2021).
  * Markert et al. (2020) Philipp Markert, Daniel V Bailey, Maximilian Golla, Markus Dürmuth, and Adam J Aviv. 2020.  This pin can be easily guessed: Analyzing the security of smartphone unlock pins. In _2020 IEEE Symposium on Security and Privacy (SP)_. IEEE, 286–303.
  * Markert et al. (2021) Philipp Markert, Daniel V Bailey, Maximilian Golla, Markus Dürmuth, and Adam J Aviv. 2021.  On the security of smartphone unlock PINs.  _ACM Transactions on Privacy and Security (TOPS)_ 24, 4 (2021), 1–36.
  * Markert et al. (2019) Philipp Markert, Florian Farke, and Markus Dürmuth. 2019.  View the email to get hacked: Attacking SMS-based two-factor authentication.  _Who Are You_ (2019), 1–6.
  * Markert et al. (2024) Philipp Markert, Leona Lassak, Maximilian Golla, and Markus Dürmuth. 2024.  Understanding Users’ Interaction with Login Notifications. In _Proceedings of the CHI Conference on Human Factors in Computing Systems_. 1–17.
  * Markert et al. (2022) Philipp Markert, Theodor Schnitzler, Maximilian Golla, and Markus Dürmuth. 2022.  ” As soon as it’s a risk, I want to require $\\{$MFA”$\\}$: How Administrators Configure Risk-based Authentication. In _Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)_. 483–501.
  * Marky et al. (2022) Karola Marky, Kirill Ragozin, George Chernyshov, Andrii Matviienko, Martin Schmitz, Max Mühlhäuser, Chloe Eghtebas, and Kai Kunze. 2022.  “Nah, it’s just annoying!” A Deep Dive into User Perceptions of Two-Factor Authentication.  _ACM transactions on computer-human interaction_ 29, 5 (2022), 1–32.
  * Marky et al. (2020) Karola Marky, Martin Schmitz, Verena Zimmermann, Martin Herbers, Kai Kunze, and Max Mühlhäuser. 2020.  3d-auth: Two-factor authentication with personalized 3d-printed items. In _Proceedings of the 2020 chi conference on human factors in computing systems_. 1–12.
  * Marne et al. (2017) Sonali Tukaram Marne, Mahdi Nasrullah Al-Ameen, and Matthew K Wright. 2017.  Learning System-assigned Passwords: A Preliminary Study on the People with Learning Disabilities.. In _SOUPS_.
  * Matthew D. Green (2012) Matthew D. Green. 2012.  _iCloud: Who holds the key?_
  * Matthews et al. (2016) Tara Matthews, Kerwell Liao, Anna Turner, Marianne Berkovich, Robert Reeder, and Sunny Consolvo. 2016.  ” She’ll just grab any device that’s closer” A Study of Everyday Device & Account Sharing in Households. In _Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems_. 5921–5932.
  * Max Eddy) (2024) Max Eddy). 2024.  So You’re Locked Out of Your Two-Factor Authentication App. Don’t Panic.  https://www.nytimes.com/wirecutter/guides/locked-out-two-factor-authentication-app-recovery/.  April 2024.
  * Mazurek et al. (2013) Michelle L Mazurek, Saranga Komanduri, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Patrick Gage Kelley, Richard Shay, and Blase Ur. 2013.  Measuring password guessability for an entire university. In _Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security_. 173–186.
  * Melicher et al. (2016a) William Melicher, Darya Kurilova, Sean M Segreti, Pranshu Kalvani, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L Mazurek. 2016a.  Usability and security of text passwords on mobile devices. In _Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems_. 527–539.
  * Melicher et al. (2016b) William Melicher, Blase Ur, Sean M Segreti, Saranga Komanduri, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2016b.  Fast, lean, and accurate: Modeling password guessability using neural networks. In _25th USENIX Security Symposium (USENIX Security 16)_. 175–191.
  * Meng et al. (2016) Weizhi Meng, Wenjuan Li, Lijun Jiang, and Liying Meng. 2016.  On multiple password interference of touch screen patterns and text passwords. In _Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems_. 4818–4822.
  * Meta (2023) Meta. 2023.  _The Labyrinth Encrypted Message Storage Protocol_.
  * Meta (2021) Meta. September 2021.  _How WhatsApp is enabling end-to-end encrypted backups_.
  * Micallef and Arachchilage (2017) Nicholas Micallef and Nalin Asanka Gamagedara Arachchilage. 2017.  A Gamified Approach to Improve Users’ Memorability of Fall-back Authentication.. In _SOUPS_.
  * Milka (2018) Grzergor Milka. 2018.  Anatomy of account takeover. In _Enigma 2018 (Enigma 2018)_.
  * Mirian et al. (2019) Ariana Mirian, Joe DeBlasio, Stefan Savage, Geoffrey M Voelker, and Kurt Thomas. 2019.  Hack for hire: Exploring the emerging market for account hijacking. In _The World Wide Web Conference_. 1279–1289.
  * Morkonda et al. (2021) Srivathsan G Morkonda, Sonia Chiasson, and Paul C van Oorschot. 2021.  Empirical analysis and privacy implications in OAuth-based single sign-on systems. In _Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society_. 195–208.
  * Morkonda et al. (2022) Srivathsan G Morkonda, Sonia Chiasson, and Paul C van Oorschot. 2022.  ” Sign in with… Privacy”: Timely Disclosure of Privacy Differences among Web SSO Login Options.  _arXiv preprint arXiv:2209.04490_ (2022).
  * Mulliner et al. (2013) Collin Mulliner, Ravishankar Borgaonkar, Patrick Stewin, and Jean-Pierre Seifert. 2013.  SMS-Based One-Time Passwords: Attacks and Defense: (Short Paper). In _Detection of Intrusions and Malware, and Vulnerability Assessment: 10th International Conference, DIMVA 2013, Berlin, Germany, July 18-19, 2013. Proceedings 10_. Springer, 150–159.
  * Munyendo et al. (2023a) Collins W Munyendo, Yasemin Acar, and Adam J Aviv. 2023a.  ” In Eighty Percent of the Cases, I Select the Password for Them”: Security and Privacy Challenges, Advice, and Opportunities at Cybercafes in Kenya. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE, 570–587.
  * Munyendo et al. (2022) Collins W Munyendo, Philipp Markert, Alexandra Nisenoff, Miles Grant, Elena Korkes, Blase Ur, and Adam J Aviv. 2022.  ” The Same $\\{$PIN$\\}$, Just Longer”: On the ($\\{$In) Security$\\}$ of Upgrading $\\{$PINs$\\}$ from 4 to 6 Digits. In _31st USENIX Security Symposium (USENIX Security 22)_. 4023–4040.
  * Munyendo et al. (2023b) Collins W Munyendo, Peter Mayer, and Adam J Aviv. 2023b.  ” I just stopped using one and started using the other”: Motivations, Techniques, and Challenges When Switching Password Managers. In _Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security_. 3123–3137.
  * Naiakshina et al. (2019) Alena Naiakshina, Anastasia Danilova, Eva Gerlitz, Emanuel Von Zezschwitz, and Matthew Smith. 2019.  ” If you want, I can store the encrypted password” A Password-Storage Field Study with Freelance Developers. In _Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems_. 1–12.
  * Naiakshina et al. (2017) Alena Naiakshina, Anastasia Danilova, Christian Tiefenau, Marco Herzog, Sergej Dechand, and Matthew Smith. 2017.  Why do developers get password storage wrong? A qualitative usability study. In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_. 311–328.
  * Nicholson et al. (2013) James Nicholson, Lynne Coventry, and Pam Briggs. 2013.  Age-related performance issues for PIN and face-based authentication systems. In _Proceedings of the SIGCHI Conference on Human Factors in Computing Systems_. 323–332.
  * Nisenoff et al. (2023) Alexandra Nisenoff, Maximilian Golla, Miranda Wei, Juliette Hainline, Hayley Szymanek, Annika Braun, Annika Hildebrandt, Blair Christensen, David Langenberg, and Blase Ur. 2023.  A $\\{$Two-Decade$\\}$ Retrospective Analysis of a University’s Vulnerability to Attacks Exploiting Reused Passwords. In _32nd USENIX Security Symposium (USENIX Security 23)_. 5127–5144.
  * Novak et al. (2017) Christopher Novak, Jim Blythe, Ross Koppel, Vijay H Kothari, and Sean W Smith. 2017.  Modeling Aggregate Security with User Agents that Employ Password Memorization Techniques.. In _SOUPS_.
  * Oduguwa and Arabo (2024) Tunde Oduguwa and Abdullahi Arabo. 2024.  Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics.  _Journal of Cybersecurity and Privacy_ 4, 2 (2024), 278–297.
  * Oesch and Ruoti (2020) Sean Oesch and Scott Ruoti. 2020.  That was then, this is now: A security evaluation of password generation, storage, and autofill in browser-based password managers. In _Proceedings of the 29th USENIX Conference on Security Symposium_. 2165–2182.
  * Oesch et al. (2022) Sean Oesch, Scott Ruoti, James Simmons, and Anuj Gautam. 2022.  “It Basically Started Using Me:” An Observational Study of Password Manager Usage. In _Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems_. 1–23.
  * Oest et al. (2019) Adam Oest, Yeganeh Safaei, Adam Doupé, Gail-Joon Ahn, Brad Wardman, and Kevin Tyers. 2019.  Phishfarm: A scalable framework for measuring the effectiveness of evasion techniques against browser phishing blacklists. In _2019 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1344–1361.
  * Oest et al. (2020) Adam Oest, Penghui Zhang, Brad Wardman, Eric Nunes, Jakub Burgis, Ali Zand, Kurt Thomas, Adam Doupé, and Gail-Joon Ahn. 2020.  Sunrise to sunset: Analyzing the end-to-end life cycle and effectiveness of phishing attacks at scale. In _29th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 20)_.
  * Oogami et al. (2020) Wataru Oogami, Hidehito Gomi, Shuji Yamaguchi, Shota Yamanaka, and Tatsuru Higurashi. 2020.  Observation study on usability challenges for fingerprint authentication using WebAuthn-enabled android smartphones.  _Age_ 20 (2020), 29.
  * Orsini et al. (2023) Chris Orsini, Alessandra Scafuro, and Tanner Verber. 2023.  How to Recover a Cryptographic Secret From the Cloud.  _Cryptology ePrint Archive_ (2023).
  * Owens et al. (2021) Kentrell Owens, Olabode Anise, Amanda Krauss, and Blase Ur. 2021.  User perceptions of the usability and security of smartphones as $\\{$FIDO2$\\}$ roaming authenticators. In _Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021)_. 57–76.
  * Pal et al. (2019) Bijeeta Pal, Tal Daniel, Rahul Chatterjee, and Thomas Ristenpart. 2019.  Beyond credential stuffing: Password similarity models using neural networks. In _2019 IEEE Symposium on Security and Privacy (SP)_. IEEE, 417–434.
  * Pal et al. (2022) Bijeeta Pal, Mazharul Islam, Marina Sanusi Bohuk, Nick Sullivan, Luke Valenta, Tara Whalen, Christopher Wood, Thomas Ristenpart, and Rahul Chatterjee. 2022.  Might I get pwned: A second generation compromised credential checking service. In _31st USENIX Security Symposium (USENIX Security 22)_. 1831–1848.
  * Panjwani and Prakash (2014) Saurabh Panjwani and Achintya Prakash. 2014.  Crowdsourcing attacks on biometric systems. In _10th Symposium On Usable Privacy and Security (SOUPS 2014)_. 257–269.
  * Parkin et al. (2016) Simon Parkin, Samy Driss, Kat Krol, and M Angela Sasse. 2016.  Assessing the user experience of password reset policies in a university. In _Technology and Practice of Passwords: 9th International Conference, PASSWORDS 2015, Cambridge, UK, December 7–9, 2015, Proceedings 9_. Springer, 21–38.
  * Pasquini et al. (2021) Dario Pasquini, Ankit Gangwal, Giuseppe Ateniese, Massimo Bernaschi, and Mauro Conti. 2021.  Improving password guessing via representation learning. In _2021 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1382–1399.
  * Paudel et al. (2023) Rizu Paudel, Prakriti Dumaru, Ankit Shrestha, Huzeyfe Kocabas, and Mahdi Nasrullah Al-Ameen. 2023.  A Deep Dive into User’s Preferences and Behavior around Mobile Phone Sharing.  _Proceedings of the ACM on Human-Computer Interaction_ 7, CSCW1 (2023), 1–22.
  * Pearman et al. (2017) Sarah Pearman, Jeremy Thomas, Pardis Emami Naeini, Hana Habib, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Serge Egelman, and Alain Forget. 2017.  Let’s go in for a closer look: Observing passwords in their natural habitat. In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_. 295–310.
  * Pearman et al. (2019) Sarah Pearman, Shikun Aerin Zhang, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2019.  Why people (don’t) use password managers effectively. In _Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019)_. 319–338.
  * Petsas et al. (2015) Thanasis Petsas, Giorgos Tsirantonakis, Elias Athanasopoulos, and Sotiris Ioannidis. 2015.  Two-factor authentication: is the world ready? Quantifying 2FA adoption. In _Proceedings of the eighth european workshop on system security_. 1–7.
  * Pew Research Center (2024) Pew Research Center. 2024.  _Mobile Fact Sheet_.
  * Pfeffer et al. (2021) Katharina Pfeffer, Alexandra Mai, Adrian Dabrowski, Matthias Gusenbauer, Philipp Schindler, Edgar Weippl, Michael Franz, and Katharina Krombholz. 2021.  On the usability of authenticity checks for hardware security tokens. In _30th USENIX Security Symposium (USENIX Security 21)_. 37–54.
  * Pinchot and Paullet (2012) Jamie L Pinchot and Karen L Paullet. 2012.  What’s in your profile? Mapping Facebook profile data to personal security questions.  _Issues in Information Systems_ 13, 1 (2012), 284–293.
  * Pochat et al. (2018) Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczyński, and Wouter Joosen. 2018.  Tranco: A research-oriented top sites ranking hardened against manipulation.  _arXiv preprint arXiv:1806.01156_ (2018).
  * Pöhn et al. (2023) Daniela Pöhn, Nils Gruschka, Leonhard Ziegler, and Andre Büttner. 2023.  A framework for analyzing authentication risks in account networks.  _Computers & Security_ 135 (2023), 103515.
  * Polakis et al. (2014) Iasonas Polakis, Panagiotis Ilia, Federico Maggi, Marco Lancini, Georgios Kontaxis, Stefano Zanero, Sotiris Ioannidis, and Angelos D Keromytis. 2014.  Faces in the distorting mirror: Revisiting photo-based social authentication. In _Proceedings of the 2014 ACM SIGSAC conference on computer and communications security_. 501–512.
  * Polakis et al. (2012) Iasonas Polakis, Marco Lancini, Georgios Kontaxis, Federico Maggi, Sotiris Ioannidis, Angelos D Keromytis, and Stefano Zanero. 2012.  All your face are belong to us: Breaking facebook’s social authentication. In _Proceedings of the 28th annual computer security applications conference_. 399–408.
  * PreVeil (2019) PreVeil. 2019.  _PreVeil Security and Design: A Description of the PreVeil System Architecture_.
  * Proton (2024) Proton. 2024.  _Set account recovery methods in case you forget your Proton password_.
  * Quermann et al. (2018) Nils Quermann, Marian Harbach, and Markus Dürmuth. 2018.  The state of user authentication in the wild.  _WAY_ 18 (2018).
  * Rabkin (2008) Ariel Rabkin. 2008.  Personal knowledge questions for fallback authentication: Security questions in the era of Facebook. In _Proceedings of the 4th Symposium on Usable Privacy and Security_. 13–23.
  * Raptis et al. (2021) George E Raptis, Christina Katsini, Andrew Jian-Lan Cen, Nalin Asanka Gamagedara Arachchilage, and Lennart E Nacke. 2021.  Better, funner, stronger: a gameful approach to nudge people into making less predictable graphical password choices. In _Proceedings of the 2021 CHI conference on human factors in computing systems_. 1–17.
  * Ray et al. (2021) Hirak Ray, Flynn Wolf, Ravi Kuber, and Adam J Aviv. 2021.  Why older adults (Don’t) use password managers. In _30th USENIX Security Symposium (USENIX Security 21)_. 73–90.
  * Reaves et al. (2016) Bradley Reaves, Nolen Scaife, Dave Tian, Logan Blue, Patrick Traynor, and Kevin RB Butler. 2016.  Sending out an SMS: Characterizing the Security of the SMS Ecosystem with Public Gateways. In _2016 IEEE Symposium on Security and Privacy (SP)_. IEEE, 339–356.
  * Redmiles et al. (2017) Elissa M Redmiles, Everest Liu, and Michelle L Mazurek. 2017.  You Want Me To Do What? A Design Study of Two-Factor Authentication Messages.. In _SOUPS_ , Vol. 57. 93.
  * Reese et al. (2019) Ken Reese, Trevor Smith, Jonathan Dutson, Jonathan Armknecht, Jacob Cameron, and Kent Seamons. 2019.  A usability study of five $\\{$two-factor$\\}$ authentication methods. In _Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019)_. 357–370.
  * Reynolds et al. (2020) Joshua Reynolds, Nikita Samarin, Joseph Barnes, Taylor Judd, Joshua Mason, Michael Bailey, and Serge Egelman. 2020.  Empirical Measurement of Systemic $\\{$2FA$\\}$ Usability. In _29th USENIX Security Symposium (USENIX Security 20)_. 127–143.
  * Reynolds et al. (2018) Joshua Reynolds, Trevor Smith, Ken Reese, Luke Dickinson, Scott Ruoti, and Kent Seamons. 2018.  A tale of two studies: The best and worst of yubikey usability. In _2018 IEEE Symposium on Security and Privacy (SP)_. IEEE, 872–888.
  * Rezaeighaleh and Zou (2019) Hossein Rezaeighaleh and Cliff C Zou. 2019.  New secure approach to backup cryptocurrency wallets. In _2019 IEEE Global Communications Conference (GLOBECOM)_. IEEE, 1–6.
  * Ruoti et al. (2016) Scott Ruoti, Jeff Andersen, and Kent Seamons. 2016.  Strengthening password-based authentication. In _Twelfth Symposium on Usable Privacy and Security (SOUPS 2016)_.
  * Sae-Bae et al. (2012) Napa Sae-Bae, Kowsar Ahmed, Katherine Isbister, and Nasir Memon. 2012.  Biometric-rich gestures: a novel approach to authentication on multi-touch devices. In _proceedings of the SIGCHI Conference on Human Factors in Computing Systems_. 977–986.
  * Sahin et al. (2023) Sena Sahin, Suood Al Roomi, Tara Poteat, and Frank Li. 2023.  Investigating the Password Policy Practices of Website Administrators. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE, 552–569.
  * Sahin and Li (2021) Sena Sahin and Frank Li. 2021.  Don’t forget the stuffing! revisiting the security impact of typo-tolerant password authentication. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 252–270.
  * Sambasivan et al. (2018) Nithya Sambasivan, Garen Checkley, Amna Batool, Nova Ahmed, David Nemer, Laura Sanely Gaytán-Lugo, Tara Matthews, Sunny Consolvo, and Elizabeth Churchill. 2018.  ” Privacy is not for me, it’s for those rich women”: Performative Privacy Practices on Mobile Phones by Women in South Asia. In _Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018)_. 127–142.
  * Sampath Srinivas (2022) Sampath Srinivas. 2022.  _One step closer to a passwordless future_.
  * Scafuro (2019) Alessandra Scafuro. 2019.  Break-glass encryption. In _Public-Key Cryptography–PKC 2019: 22nd IACR International Conference on Practice and Theory of Public-Key Cryptography, Beijing, China, April 14-17, 2019, Proceedings, Part II 22_. Springer, 34–62.
  * Schechter et al. (2009) Stuart Schechter, Serge Egelman, and Robert W Reeder. 2009.  It’s not what you know, but who you know: a social approach to last-resort authentication. In _Proceedings of the sigchi conference on human factors in computing systems_. 1983–1992.
  * Segreti et al. (2017) Sean M Segreti, William Melicher, Saranga Komanduri, Darya Melicher, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L Mazurek. 2017.  Diversify to survive: Making passwords stronger with adaptive policies. In _Thirteenth symposium on usable privacy and security (SOUPS 2017)_. 1–12.
  * Seiler-Hwang et al. (2019) Sunyoung Seiler-Hwang, Patricia Arias-Cabarcos, Andrés Marín, Florina Almenares, Daniel Díaz-Sánchez, and Christian Becker. 2019.  ” I don’t see why I would ever want to use it” Analyzing the Usability of Popular Smartphone Password Managers. In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_. 1937–1953.
  * Seitz et al. (2017) Tobias Seitz, Manuel Hartmann, Jakob Pfab, and Samuel Souque. 2017.  Do differences in password policies prevent password reuse?. In _Proceedings of the 2017 CHI Conference Extended Abstracts on Human Factors in Computing Systems_. 2056–2063.
  * Senol et al. (2024) Asuman Senol, Alisha Ukani, Dylan Cutler, and Igor Bilogrevic. 2024.  The Double Edged Sword: Identifying Authentication Pages and their Fingerprinting Behavior. In _The Web Conference (WWW), 2024_.
  * Shamir (1979) Adi Shamir. 1979.  How to share a secret.  _Commun. ACM_ 22, 11 (1979), 612–613.
  * Shay et al. (2015) Richard Shay, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Alain Forget, Saranga Komanduri, Michelle L Mazurek, William Melicher, Sean M Segreti, and Blase Ur. 2015.  A spoonful of sugar? The impact of guidance and feedback on password-creation behavior. In _Proceedings of the 33rd annual ACM conference on human factors in computing systems_. 2903–2912.
  * Shay et al. (2014) Richard Shay, Saranga Komanduri, Adam L Durity, Phillip Huh, Michelle L Mazurek, Sean M Segreti, Blase Ur, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2014.  Can long passwords be secure and usable?. In _Proceedings of the SIGCHI Conference on Human Factors in Computing Systems_. 2927–2936.
  * Shirvanian et al. (2014) Maliheh Shirvanian, Stanislaw Jarecki, Nitesh Saxena, and Naveen Nathan. 2014.  Two-Factor Authentication Resilient to Server Compromise Using Mix-Bandwidth Devices.. In _NDSS_.
  * Siadati et al. (2017) Hossein Siadati, Toan Nguyen, Payas Gupta, Markus Jakobsson, and Nasir Memon. 2017.  Mind your SMSes: Mitigating social engineering in second factor authentication.  _Computers & Security_ 65 (2017), 14–28.
  * Silver et al. (2014) David Silver, Suman Jana, Dan Boneh, Eric Chen, and Collin Jackson. 2014.  Password managers: Attacks and defenses. In _23rd USENIX Security Symposium (USENIX Security 14)_. 449–464.
  * Singh et al. (2007) Supriya Singh, Anuja Cabraal, Catherine Demosthenous, Gunela Astbrink, and Michele Furlong. 2007.  Password sharing: implications for security design based on social practice. In _Proceedings of the SIGCHI conference on Human factors in computing systems_. 895–904.
  * Sluganovic et al. (2016) Ivo Sluganovic, Marc Roeschlin, Kasper B Rasmussen, and Ivan Martinovic. 2016.  Using reflexive eye movements for fast challenge-response authentication. In _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_. 1056–1067.
  * Smith et al. (2023) Garrett Smith, Tarun Yadav, Jonathan Dutson, Scott Ruoti, and Kent Seamons. 2023.  ” If I could do this, I feel anyone $\\{$could:$\\}$” The Design and Evaluation of a Secondary Authentication Factor Manager. In _32nd USENIX Security Symposium (USENIX Security 23)_. 499–515.
  * Smith et al. (2017) Trevor Smith, Scott Ruoti, and Kent E Seamons. 2017.  Augmenting Centralized Password Management with Application-Specific Passwords.. In _SOUPS_.
  * Somorovsky et al. (2012) Juraj Somorovsky, Andreas Mayer, Jörg Schwenk, Marco Kampmann, and Meiko Jensen. 2012.  On breaking $\\{$SAML$\\}$: Be whoever you want to be. In _21st USENIX Security Symposium (USENIX Security 12)_. 397–412.
  * Song et al. (2017) Yunpeng Song, Zhongmin Cai, and Zhi-Li Zhang. 2017.  Multi-touch authentication using hand geometry and behavioral information. In _2017 IEEE symposium on security and privacy (SP)_. IEEE, 357–372.
  * Song et al. (2019) Yunpeng Song, Cori Faklaris, Zhongmin Cai, Jason I Hong, and Laura Dabbish. 2019.  Normal and easy: Account sharing practices in the workplace.  _Proceedings of the ACM on Human-Computer Interaction_ 3, CSCW (2019), 1–25.
  * StartMail (2024) StartMail. 2024.  I forgot my password - now what?  https://support.startmail.com/hc/en-us/articles/360007388898--I-forgot-my-password-now-what.  Last accessed 1 June 2024.
  * Stavova et al. (2016) Vlasta Stavova, Vashek Matyas, and Mike Just. 2016.  Codes v. people: A comparative usability study of two password recovery mechanisms. In _Information Security Theory and Practice: 10th IFIP WG 11.2 International Conference, WISTP 2016, Heraklion, Crete, Greece, September 26–27, 2016, Proceedings 10_. Springer, 35–50.
  * Stobert and Biddle (2018) Elizabeth Stobert and Robert Biddle. 2018.  The password life cycle.  _ACM Transactions on Privacy and Security (TOPS)_ 21, 3 (2018), 1–32.
  * Sun et al. (2015) He Sun, Kun Sun, Yuewu Wang, and Jiwu Jing. 2015.  TrustOTP: Transforming smartphones into secure one-time password tokens. In _Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security_. 976–988.
  * Sun and Beznosov (2012) San-Tsai Sun and Konstantin Beznosov. 2012.  The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems. In _Proceedings of the 2012 ACM conference on Computer and communications security_. 378–390.
  * Sun et al. (2010) San-Tsai Sun, Yazan Boshmaf, Kirstie Hawkey, and Konstantin Beznosov. 2010.  A billion keys, but few locks: the crisis of web single sign-on. In _Proceedings of the 2010 new security paradigms workshop_. 61–72.
  * Sun et al. (2012) San-Tsai Sun, Kirstie Hawkey, and Konstantin Beznosov. 2012.  Systematically breaking and fixing OpenID security: Formal analysis, semi-automated empirical evaluation, and practical countermeasures.  _Computers & Security_ 31, 4 (2012), 465–483.
  * Sun et al. (2011) San-Tsai Sun, Eric Pospisil, Ildar Muslukhov, Nuray Dindar, Kirstie Hawkey, and Konstantin Beznosov. 2011.  What makes users refuse web single sign-on? An empirical investigation of OpenID. In _Proceedings of the seventh symposium on usable privacy and security_. 1–20.
  * Sun et al. (2013) San-Tsai Sun, Eric Pospisil, Ildar Muslukhov, Nuray Dindar, Kirstie Hawkey, and Konstantin Beznosov. 2013.  Investigating users’ perspectives of web single sign-on: Conceptual gaps and acceptance model.  _ACM Transactions on Internet Technology (TOIT)_ 13, 1 (2013), 1–35.
  * Takakuwa (2019) Alex Takakuwa. 2019.  _Moving from Passwords to Authenticators_.  Ph. D. Dissertation.
  * Tan et al. (2020) Joshua Tan, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2020.  Practical recommendations for stronger, more usable passwords combining minimum-strength, minimum-length, and blocklist requirements. In _Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security_. 1407–1426.
  * Taryn Plumb) (2024) Taryn Plumb). 2024.  Face off: Attackers are stealing biometrics to access victims’ bank accounts.  https://venturebeat.com/security/face-off-attackers-are-stealing-biometrics-to-access-victims-bank-accounts/.  February 2024.
  * Tey et al. (2013) Chee Meng Tey, Payas Gupta, and Debin Gao. 2013.  I can be you: Questioning the use of keystroke dynamics as biometrics.  (2013).
  * Theofanos et al. (2021) Mary Theofanos, Yee-Yin Choong, and Olivia Murphy. 2021.  ’Passwords Keep Me Safe’–Understanding What Children Think about Passwords. In _30th USENIX Security Symposium (USENIX Security 21)_. 19–35.
  * Thomas et al. (2017) Kurt Thomas, Frank Li, Ali Zand, Jacob Barrett, Juri Ranieri, Luca Invernizzi, Yarik Markov, Oxana Comanescu, Vijay Eranti, Angelika Moscicki, et al. 2017\.  Data breaches, phishing, or malware? Understanding the risks of stolen credentials. In _Proceedings of the 2017 ACM SIGSAC conference on computer and communications security_. 1421–1434.
  * Thomas et al. (2019) Kurt Thomas, Jennifer Pullman, Kevin Yeo, Ananth Raghunathan, Patrick Gage Kelley, Luca Invernizzi, Borbala Benko, Tadek Pietraszek, Sarvar Patel, Dan Boneh, et al. 2019\.  Protecting accounts from credential stuffing with password breach alerting. In _28th USENIX Security Symposium (USENIX Security 19)_. 1556–1571.
  * Thorpe et al. (2014) Julie Thorpe, Muath Al-Badawi, Brent MacRae, and Amirali Salehi-Abari. 2014.  The presentation effect on graphical passwords. In _proceedings of the SIGCHI conference on human factors in computing systems_. 2947–2950.
  * Tian et al. (2013) Jing Tian, Chengzhang Qu, Wenyuan Xu, and Song Wang. 2013.  KinWrite: Handwriting-Based Authentication Using Kinect.. In _NDSS_ , Vol. 93. 94.
  * Troncoso and Hale (2021) Michael Troncoso and Britta Hale. 2021.  The Bluetooth cyborg: Analysis of the full human-machine passkey entry AKE protocol.  _Cryptology ePrint Archive_ (2021).
  * Turner et al. (2023) Mark Turner, Martin Schmitz, Morgan Masichi Bierey, Mohamed Khamis, and Karola Marky. 2023.  Tangible $\\{$2FA$\\}$–An $\\{$In-the-Wild$\\}$ Investigation of $\\{$User-Defined$\\}$ Tangibles for $\\{$Two-Factor$\\}$ Authentication. In _Nineteenth Symposium on Usable Privacy and Security (SOUPS 2023)_. 245–261.
  * Uellenbeck et al. (2013) Sebastian Uellenbeck, Markus Dürmuth, Christopher Wolf, and Thorsten Holz. 2013.  Quantifying the security of graphical passwords: The case of android unlock patterns. In _Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security_. 161–172.
  * Ulqinaku et al. (2021) Enis Ulqinaku, Hala Assal, AbdelRahman Abdou, Sonia Chiasson, and Srdjan Capkun. 2021.  Is real-time phishing eliminated with $\\{$FIDO$\\}$? social engineering downgrade attacks against $\\{$FIDO$\\}$ protocols. In _30th USENIX Security Symposium (USENIX Security 21)_. 3811–3828.
  * Ur et al. (2016) Blase Ur, Jonathan Bees, Sean M Segreti, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2016.  Do users’ perceptions of password security match reality?. In _Proceedings of the 2016 CHI conference on human factors in computing systems_. 3748–3760.
  * Ur et al. (2012) Blase Ur, Patrick Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass, Michelle L Mazurek, Timothy Passaro, Richard Shay, Timothy Vidas, Lujo Bauer, et al. 2012\.  How does your password measure up? The effect of strength meters on password creation. In _21st USENIX security symposium (USENIX Security 12)_. 65–80.
  * Ur et al. (2015a) Blase Ur, Fumiko Noma, Jonathan Bees, Sean M Segreti, Richard Shay, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2015a.  ” I Added’!’at the End to Make It Secure”: Observing Password Creation in the Lab. In _Eleventh symposium on usable privacy and security (SOUPS 2015)_. 123–140.
  * Ur et al. (2015b) Blase Ur, Sean M Segreti, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Saranga Komanduri, Darya Kurilova, Michelle L Mazurek, William Melicher, and Richard Shay. 2015b.  Measuring $\\{$Real-World$\\}$ Accuracies and Biases in Modeling Password Guessability. In _24th USENIX Security Symposium (USENIX Security 15)_. 463–481.
  * Van Koningsbruggen et al. (2021) Rosa Van Koningsbruggen, Bart Hengeveld, and Jason Alexander. 2021.  Understanding the Design Space of Embodied Passwords based on Muscle Memory. In _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_. 1–13.
  * Veras et al. (2014) Rafael Veras, Christopher Collins, and Julie Thorpe. 2014.  On semantic patterns of passwords and their security impact.. In _NDSS_. Citeseer.
  * Voskobojnikov et al. (2021) Artemij Voskobojnikov, Oliver Wiese, Masoud Mehrabi Koushki, Volker Roth, and Konstantin Beznosov. 2021.  The u in crypto stands for usable: An empirical study of user experience with mobile cryptocurrency wallets. In _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_. 1–14.
  * WABetaInfo (2023) WABetaInfo. 2023.  _Apple is releasing password reminder for end-to-end encrypted backups_.
  * Wang et al. (2016a) Chen Wang, Xiaonan Guo, Yan Wang, Yingying Chen, and Bo Liu. 2016a.  Friend or foe? Your wearable devices reveal your personal pin. In _Proceedings of the 11th ACM on Asia conference on computer and communications security_. 189–200.
  * Wang et al. (2023a) Ding Wang, Xuan Shan, Qiying Dong, Yaosheng Shen, and Chunfu Jia. 2023a.  No single silver bullet: Measuring the accuracy of password strength meters. In _32nd USENIX Security Symposium (USENIX Security 23)_. 947–964.
  * Wang et al. (2019) Ding Wang, Ping Wang, Debiao He, and Yuan Tian. 2019.  Birthday, name and bifacial-security: understanding passwords of Chinese web users. In _28th USENIX security symposium (USENIX security 19)_. 1537–1555.
  * Wang et al. (2016b) Ding Wang, Zijian Zhang, Ping Wang, Jeff Yan, and Xinyi Huang. 2016b.  Targeted online password guessing: An underestimated threat. In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_. 1242–1254.
  * Wang et al. (2022b) Ding Wang, Yunkai Zou, Qiying Dong, Yuanming Song, and Xinyi Huang. 2022b.  How to attack and generate honeywords. In _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 966–983.
  * Wang et al. (2023b) Ding Wang, Yunkai Zou, Yuan-An Xiao, Siqi Ma, and Xiaofeng Chen. 2023b.  $\\{$Pass2Edit$\\}$: A $\\{$Multi-Step$\\}$ Generative Model for Guessing Edited Passwords. In _32nd USENIX Security Symposium (USENIX Security 23)_. 983–1000.
  * Wang et al. (2023c) Ding Wang, Yunkai Zou, Zijian Zhang, and Kedong Xiu. 2023c.  Password guessing using random forest. In _32nd USENIX Security Symposium (USENIX Security 23)_. 965–982.
  * Wang et al. (2015) Hui Wang, Yuanyuan Zhang, Juanru Li, Hui Liu, Wenbo Yang, Bodong Li, and Dawu Gu. 2015.  Vulnerability assessment of oauth implementations in android applications. In _Proceedings of the 31st annual computer security applications conference_. 61–70.
  * Wang and Reiter (2018) Ke Coby Wang and Michael K Reiter. 2018.  How to end password reuse on the web.  _arXiv preprint arXiv:1805.00566_ (2018).
  * Wang et al. (2012) Rui Wang, Shuo Chen, and XiaoFeng Wang. 2012.  Signing me onto your accounts through facebook and google: A traffic-guided security study of commercially deployed single-sign-on web services. In _2012 IEEE Symposium on Security and Privacy_. IEEE, 365–379.
  * Wang et al. (2013) Rui Wang, Yuchen Zhou, Shuo Chen, Shaz Qadeer, David Evans, and Yuri Gurevich. 2013.  Explicating $\\{$SDKs$\\}$: uncovering assumptions underlying secure authentication and authorization. In _22nd USENIX Security Symposium (USENIX Security 13)_. 399–314.
  * Wang et al. (2022a) Serena Wang, Cori Faklaris, Junchao Lin, Laura Dabbish, and Jason I Hong. 2022a.  ’It’s Problematic but I’m not Concerned’: University Perspectives on Account Sharing.  _Proceedings of the ACM on Human-Computer Interaction_ 6, CSCW1 (2022), 1–27.
  * Wash et al. (2016) Rick Wash, Emilee Rader, Ruthie Berman, and Zac Wellmer. 2016.  Understanding password choices: How frequently entered passwords are re-used across websites. In _Twelfth Symposium on Usable Privacy and Security (SOUPS 2016)_. 175–188.
  * Wei et al. (2024) Miranda Wei, Jaron Mink, Yael Eiger, Tadayoshi Kohno, Elissa M Redmiles, and Franziska Roesner. 2024.  SoK (or SoLK?): On the Quantitative Study of Sociodemographic Factors and Computer Security Behaviors.  _arXiv preprint arXiv:2404.10187_ (2024).
  * Wes Davis (2023) Wes Davis. June 2023.  Apple IDs now support passkeys — if you’re on the iOS 17 or macOS Sonoma betas.  https://www.theverge.com/2023/6/20/23767583/apple-iphone-ios-17-beta-passkey.  (June 2023).
  * Westers et al. (2023) Maximilian Westers, Tobias Wich, Louis Jannett, Vladislav Mladenov, Christian Mainka, and Andreas Mayer. 2023.  SSO-monitor: fully-automatic large-scale landscape, security, and privacy analyses of single sign-on in the wild.  _arXiv preprint arXiv:2302.01024_ (2023).
  * WhatsApp (2021) WhatsApp. 2021.  _Security of End-To-End Encrypted Backups_.
  * WhatsApp (2023) WhatsApp. 2023.  _Can’t remember password for encrypted backup_.
  * Wheeler (2016) Daniel Lowe Wheeler. 2016.  zxcvbn:$\\{$Low-Budget$\\}$ Password Strength Estimation. In _25th USENIX Security Symposium (USENIX Security 16)_. 157–173.
  * Wiefling et al. (2020) Stephan Wiefling, Markus Dürmuth, and Luigi Lo Iacono. 2020.  More than just good passwords? A study on usability and security perceptions of risk-based authentication. In _Proceedings of the 36th Annual Computer Security Applications Conference_. 203–218.
  * Wiefling et al. (2022) Stephan Wiefling, Paul René Jørgensen, Sigurd Thunem, and Luigi Lo Iacono. 2022.  Pump up password security! Evaluating and enhancing risk-based authentication on a real-world large-scale online service.  _ACM Transactions on Privacy and Security_ 26, 1 (2022), 1–36.
  * Wiefling et al. (2019) Stephan Wiefling, Luigi Lo Iacono, and Markus Dürmuth. 2019.  Is this really you? An empirical study on risk-based authentication applied in the wild. In _ICT Systems Security and Privacy Protection: 34th IFIP TC 11 International Conference, SEC 2019, Lisbon, Portugal, June 25-27, 2019, Proceedings 34_. Springer, 134–148.
  * Wiefling et al. (2021) Stephan Wiefling, Jan Tolsdorf, and Luigi Lo Iacono. 2021.  Privacy considerations for risk-based authentication systems. In _2021 IEEE European Symposium on Security and Privacy Workshops (EuroS &PW)_. IEEE, 320–327.
  * World Wide Web Consortium (2023) (W3C) World Wide Web Consortium (W3C). 2023.  Web Authentication: An API for accessing Public Key Credentials Level 3.  https://www.w3.org/TR/webauthn-3/.  Last accessed 28th May 2024.
  * Worldcoin Foundation (2024) Worldcoin Foundation. 2024.  Worldcoin – A New Identity and Financial Network.  https://whitepaper.worldcoin.org/.  Last accessed 31st May 2024.
  * Wu et al. (2020) Cong Wu, Kun He, Jing Chen, Ziming Zhao, and Ruiying Du. 2020.  Liveness is not enough: Enhancing fingerprint authentication with behavioral biometrics to defeat puppet attacks. In _29th USENIX Security Symposium (USENIX Security 20)_. 2219–2236.
  * Wu et al. (2023b) Shujiang Wu, Pengfei Sun, Yao Zhao, and Yinzhi Cao. 2023b.  Him of Many Faces: Characterizing Billion-scale Adversarial and Benign Browser Fingerprints on Commercial Websites.. In _NDSS_.
  * Wu et al. (2022) Yuxi Wu, W Keith Edwards, and Sauvik Das. 2022.  SoK: Social Cybersecurity. In _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1863–1879.
  * Wu et al. (2023a) Zhihao Wu, Yushi Cheng, Jiahui Yang, Xiaoyu Ji, and Wenyuan Xu. 2023a.  DepthFake: Spoofing 3D Face Authentication with a 2D Photo. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE, 917–91373.
  * Würsching et al. (2023) Leon Würsching, Florentin Putz, Steffen Haesler, and Matthias Hollick. 2023.  FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones. In _Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems_. 1–16.
  * Xu et al. (2014) Hui Xu, Yangfan Zhou, and Michael R Lyu. 2014.  Towards continuous and passive authentication via touch biometrics: An experimental study on smartphones. In _10th Symposium On Usable Privacy and Security (SOUPS 2014)_. 187–198.
  * Xu et al. (2023) Ming Xu, Jitao Yu, Xinyi Zhang, Chuanwang Wang, Shenghao Zhang, Haoqi Wu, and Weili Han. 2023.  Improving real-world password guessing attacks via bi-directional transformers. In _32nd USENIX Security Symposium (USENIX Security 23)_. 1001–1018.
  * Yan et al. (2012) Qiang Yan, Jin Han, Yingjiu Li, Huijie DENG, et al. 2012\.  On limitations of designing usable leakage-resilient password systems: Attacks, principles and usability.  (2012).
  * Yan and Yang (2023) Yueli Yan and Zhice Yang. 2023.  Spoofing real-world face authentication systems through optical synthesis. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE, 882–898.
  * Yang et al. (2018) Ronghai Yang, Wing Cheong Lau, Jiongyi Chen, and Kehuan Zhang. 2018.  Vetting Single $\\{$Sign-On$\\}$$\\{$SDK$\\}$ Implementations via Symbolic Reasoning. In _27th USENIX Security Symposium (USENIX Security 18)_. 1459–1474.
  * Yang et al. (2016c) Ronghai Yang, Guanchen Li, Wing Cheong Lau, Kehuan Zhang, and Pili Hu. 2016c.  Model-based security testing: An empirical study on oauth 2.0 implementations. In _Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security_. 651–662.
  * Yang et al. (2016b) Weining Yang, Ninghui Li, Omar Chowdhury, Aiping Xiong, and Robert W Proctor. 2016b.  An empirical study of mnemonic sentence-based password generation strategies. In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_. 1216–1229.
  * Yang et al. (2016a) Yulong Yang, Gradeigh D Clark, Janne Lindqvist, and Antti Oulasvirta. 2016a.  Free-form gesture authentication in the wild. In _Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems_. 3722–3735.
  * Yi et al. (2023) Xin Yi, Shuning Zhang, Ziqi Pan, Louisa Shi, Fengyan Han, Yan Kong, Hewu Li, and Yuanchun Shi. 2023.  Squeez’in: Private authentication on smartphones based on squeezing gestures. In _Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems_. 1–15.
  * Zhang et al. (2017) Linghan Zhang, Sheng Tan, and Jie Yang. 2017.  Hearing your voice is not enough: An articulatory gesture based liveness detection for voice authentication. In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_. 57–71.
  * Zhang et al. (2016) Linghan Zhang, Sheng Tan, Jie Yang, and Yingying Chen. 2016.  Voicelive: A phoneme localization based liveness detection for voice authentication on smartphones. In _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_. 1080–1091.
  * Zhang et al. (2021) Zhiyi Zhang, Michał Król, Alberto Sonnino, Lixia Zhang, and Etienne Rivière. 2021.  EL PASSO: efficient and lightweight privacy-preserving single sign on.  _Proceedings on Privacy Enhancing Technologies_ (2021).
  * Zhao et al. (2020) Benjamin Zi Hao Zhao, Hassan Jameel Asghar, and Mohamed Ali Kaafar. 2020.  On the resilience of biometric authentication systems against random inputs.  _arXiv preprint arXiv:2001.04056_ (2020).
  * Zhao et al. (2016) Peng Zhao, Kaigui Bian, Tong Zhao, Xintong Song, Jung-Min Park, Xiaoming Li, Fan Ye, and Wei Yan. 2016.  Understanding smartphone sensor and app data for enhancing the security of secret questions.  _IEEE Transactions on Mobile Computing_ 16, 2 (2016), 552–565.
  * Zhao et al. (2013) Ziming Zhao, Gail-Joon Ahn, Jeong-Jin Seo, and Hongxin Hu. 2013.  On the security of picture gesture authentication. In _22nd USENIX Security Symposium (USENIX Security 13)_. 383–398.
  * Zhou and Evans (2014) Yuchen Zhou and David Evans. 2014.  $\\{$SSOScan$\\}$: automated testing of web applications for single $\\{$Sign-On$\\}$ vulnerabilities. In _23rd USENIX Security Symposium (USENIX Security 14)_. 495–510.
  * Zhu et al. (2014) Bin B Zhu, Jeff Yan, Dongchen Wei, and Maowei Yang. 2014.  Security analyses of click-based graphical passwords via image point memorability. In _Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security_. 1217–1231.
  * Zinkus et al. (2021) Maximilian Zinkus, Tushar M Jois, and Matthew Green. 2021.  SoK: Cryptographic confidentiality of data on mobile devices.  _arXiv preprint arXiv:2109.11007_ (2021).
  * Zviran and Haga (1990) Moshe Zviran and William J Haga. 1990.  User authentication by cognitive passwords: an empirical assessment. In _Proceedings of the 5th Jerusalem Conference on Information Technology, 1990.’Next Decade in Information Technology’_. IEEE, 137–144.

Authentication Category |  Papers
---|---
Passwords |  (Nisenoff et al., 2023; Wash et al., 2016; Inglesant and Sasse, 2010; Wang et al., 2016b; Bonneau, 2012; Pal et al., 2019; Das et al., 2014; Seitz et al., 2017; Wang et al., 2023c; Ruoti et al., 2016; Xu et al., 2023; Al-Ameen et al., 2015a; Li et al., 2014a; Dunphy et al., 2015; Silver et al., 2014; Florêncio et al., 2014; Haque et al., 2014; Wang et al., 2023b, a; Islam et al., 2023; Oesch and Ruoti, 2020; Pal et al., 2022; Ray et al., 2021; Becker et al., 2018; Smith et al., 2017; Li et al., 2014b; Pearman et al., 2019; Ur et al., 2012; Wang et al., 2019; Lyastani et al., 2018; Habib et al., 2018; Ruoti et al., 2016; Gao et al., 2018; Novak et al., 2017; Segreti et al., 2017; Melicher et al., 2016b; Wheeler, 2016; Koppel et al., 2016; Ur et al., 2015a, b; Theofanos et al., 2021; Jayakrishnan et al., 2020; Marne et al., 2017; Lai et al., 2017; ala, 2016; Hutchinson et al., 2024; Alroomi and Li, 2023; Sahin and Li, 2021; Tan et al., 2020; Seiler-Hwang et al., 2019; Joudaki et al., 2018; Golla et al., 2018; Golla and Dürmuth, 2018; Pearman et al., 2017; Chatterjee et al., 2017; Naiakshina et al., 2017; Yang et al., 2016b; Golla et al., 2016; Wang et al., 2016b; Huh et al., 2015; Zhu et al., 2014; Mazurek et al., 2013; Chatterjee et al., 2016; Kelley et al., 2012; Blocki et al., 2018; Blocki and Liu, 2023; Wang et al., 2022b; Huaman et al., 2021; Ma et al., 2014; Pasquini et al., 2021; Sahin et al., 2023; Gelernter et al., 2017; Munyendo et al., 2023a; Liu et al., 2023, 2019; Lei et al., 2023; Lee et al., 2019; Wang and Reiter, 2018; Kiesel et al., 2017; Blocki et al., 2014; de Carné de Carnavalet and Mannan, 2014; Veras et al., 2014; Castelluccia et al., 2012; Yan et al., 2012; Abdrabou et al., 2022; Oesch et al., 2022; Abdrabou et al., 2021; Khamis et al., 2019; Naiakshina et al., 2019; Huh et al., 2017; Meng et al., 2016; Ur et al., 2016; Al-Ameen et al., 2015b; Shay et al., 2015; Chowdhury et al., 2014; Egelman et al., 2013; Amft et al., 2023a; Lee et al., 2022; Munyendo et al., 2023b; Melicher et al., 2016a; Shay et al., 2014; Blocki and Zhang, 2022)
Biometric |  (Wu et al., 2020; He et al., 2022; Li et al., 2022; Xu et al., 2014; Panjwani and Prakash, 2014; Dechand et al., 2016; Chen et al., 2023; Zhang et al., 2017; Liu et al., 2017; Sluganovic et al., 2016; Zhang et al., 2016; Li et al., 2015; Chen et al., 2021a; Abdullah et al., 2021b, a; Wu et al., 2023a; Yan and Yang, 2023; Kassis and Hengartner, 2023; Zhao et al., 2020; Ba et al., 2018; Li et al., 2013; Tian et al., 2013; Tey et al., 2013; Fereidooni et al., 2023; Yi et al., 2023; Chen et al., 2021b; Koushki et al., 2021; Lewis and Venkatasubramanian, 2021; Liang et al., 2021; Van Koningsbruggen et al., 2021; Holz and Bentley, 2016; Yang et al., 2016a; De Luca et al., 2015, 2014, 2012; Sae-Bae et al., 2012; Jana et al., 2020; Abdrabou et al., 2022)
2FA |  (Gilsenan et al., 2023; Lee and Narayanan, 2021; Gerlitz et al., 2023; Amft et al., 2023b; Das et al., 2018; Reynolds et al., 2018; Colnago et al., 2018; Abbott and Patil, 2020; Dutson et al., 2019; Lassak et al., 2024a; Farke et al., 2020; Ulqinaku et al., 2021; Gavazzi et al., 2023; Mulliner et al., 2013; Lee et al., 2020; Pfeffer et al., 2021; Redmiles et al., 2017; Reese et al., 2019; Sun et al., 2015; Reaves et al., 2016; Lei et al., 2021; Shirvanian et al., 2014; Marky et al., 2020; Ciolino et al., 2019; Das et al., 2018; Reynolds et al., 2020; Turner et al., 2023; Smith et al., 2023; Ghorbani Lyastani et al., 2023; Acemyan et al., 2018; Golla et al., 2021)
SSO |  (Balash et al., 2022; Somorovsky et al., 2012; Wang et al., 2012; Ghasemisharif et al., 2022; Yang et al., 2018; Dietz and Wallach, 2014; Cho et al., 2020; Dimova et al., 2023; Kroschewski and Lehmann, 2023; Frederiksen et al., 2023; Zhang et al., 2021; Ghasemisharif et al., 2018; Fett et al., 2015; Zhou and Evans, 2014; Mainka et al., 2017; Sun and Beznosov, 2012)
Graphical Password |  (Meng et al., 2016; Zhao et al., 2013; Al-Ameen et al., 2015a; Uellenbeck et al., 2013; Song et al., 2017; Cheon et al., 2020; Cho et al., 2017; Abdelrahman et al., 2017; Cheon et al., 2023; Raptis et al., 2021; Hanamsagar et al., 2018; Buschek et al., 2016; Katsini et al., 2018; Thorpe et al., 2014)
RBA |  (Markert et al., 2024; Freeman et al., 2016; Lin et al., 2022; Wiefling et al., 2020; Wu et al., 2023b; Durey et al., 2021; Senol et al., 2024; Markert et al., 2022; Wiefling et al., 2019, 2021; Gavazzi et al., 2023)
Passwordless |  (Kepkowski et al., 2023; Lyastani et al., 2020; Lassak et al., 2024b, 2021; Kuchhal et al., 2023; Jangid et al., 2023; Troncoso and Hale, 2021; Feng et al., 2021; Würsching et al., 2023; Kepkowski et al., 2022; Owens et al., 2021)
Device PIN |  (Markert et al., 2020; Nicholson et al., 2013; Cherapau et al., 2015; Wang et al., 2016a; Markert et al., 2021; Munyendo et al., 2022; Harbach et al., 2016; Bâce et al., 2022)
Recovery Questions |  (Bonneau et al., 2015a; Albayram and Khan, 2016; Hang et al., 2015a; Zhao et al., 2016; Hang et al., 2015b; Micallef and Arachchilage, 2017; Albayram and Khan, 2015; Dandapat et al., 2015)
Social Authentication |  (Brainard et al., 2006; Schechter et al., 2009; Kim et al., 2012; Polakis et al., 2012, 2014; Javed et al., 2014; Guo et al., 2021a)
Other |  (Höltervennhoff et al., 2024; Keil et al., 2022; Harbach et al., 2013)
Table 2.  Literature search results for authentication and recovery
mechanisms. A small number of works appear under multiple categories.

##  Appendix A Secondary Authentication Mechanisms

####  A.0.1. Recovery Questions

First conceived of in 1990 (Zviran and Haga, 1990), recovery questions ask
users to answer a series of questions based on personal knowledge of the
account owner, where the questions are usually determined by the provider but
sometimes also user-generated. Frequently used historically, recovery
questions are now widely disgraced as a viable authentication scheme after
numerous studies showing that answers are low-entropy and often guessable by
other individuals personally close to the account owner (Lassak et al., 2024a;
Schechter et al., 2009; Rabkin, 2008; Just and Aspinall, 2009), a result that
has likely only gotten worse as users share troves of personal data online
(Pinchot and Paullet, 2012; Kim Zetter, 2008). To make matters worse, studies
have also repeatedly found that some users provide untruthful answers as a
means of improving their account security (Golla and Dürmuth, 2016; Bonneau et
al., 2015a; Lassak et al., 2024a), but which has a side effect of making it
more likely that the user themselves forgets the correct answer. Bonneau et
al. (Bonneau et al., 2015a) concluded back in 2015 that it is “next to
impossible to find secret questions that are both secure and memorable”.

Usage-Based Questions: A suggested variation to reduce the guessability of
recovery questions is to use “dynamic” recovery questions in which the answer
changes based on account and/or device usage patterns (Albayram and Khan,
2016; Hang et al., 2015a; Zhao et al., 2016; Hang et al., 2015c), as compared
with the traditional “static” recovery questions described above. For
instance, a service provider may ask questions based on geolocation data
(Addas et al., 2019; Hang et al., 2015b). [Sentence describing general
findings.] Users were particularly worried that they wouldn’t be able to
recall the correct answers and might lock themselves out of their own account
(Albayram and Khan, 2016), as user studies found that certain types of data
(particularly app installations) are easier to remember than others (e.g., SMS
and call history) based on how frequently the data changes.

Authentication based on usage history raises particular concerns for at-risk
demographics, such as older individuals who may struggle with memory recall,
public figures whose location history is readily accessible, or domestic abuse
victims where the attacker is generally familiar with location and
communication history. In summary, we conclude that both static and dynamic
recovery questions are unlikely to be suitable as either a standalone
authentication mechanism or as a second factor for accounts.

####  A.0.2. Email and SMS 2FA

Email and SMS 2FA are still widely used for recovery today (Li et al., 2018;
Büttner et al., 2023), both as the primary 2FA mechanism and as fallback
authentication strategies for more secure 2FA schemes (such as backups of 2FA
authenticator apps (Gilsenan et al., 2023)). We consider email and SMS 2FA
jointly as academic work has shown them to be roughly equally usable in terms
of recovery success rates and user perception (Lassak et al., 2024a; Bonneau
et al., 2015a). SMS has been the most widely deployed 2FA mechanism for at
least a decade (Mulliner et al., 2013; AlHusain and Alkhalifah, 2021; Gavazzi
et al., 2023), the most common form of which is a time-based one-time password
(TOTP). Both code-based and link-based 2FA are vulnerable to social
engineering (“real-time phishing”), as users can often be tricked into sharing
the code even when told not to do so by the companies. SMS-based
authentication codes have well-documented security issues and are easily
intercepted via SIM swapping attacks and attacks on the SS7 protocol (Siadati
et al., 2017; Lee et al., 2020; Jover, 2020; Lee and Narayanan, 2021; Markert
et al., 2019), but there are nonetheless certain scenarios (e.g., low value
accounts, a user posses only a shared email account) that may make SMS 2FA
more suitable for an individual use case, and vice versa. SMS 2FA also
typically reveals the code on the device lock screen, and in email 2FA some
prominent websites (including Google and Facebook) would reveal the code in
the email header or preheader (Al Maqbali and Mitchell, 2018).

Recovery: Recovery: While end-users have historically considered email and SMS
to be the most usable recovery options, it is nonetheless plausible that users
may lose access to one of these factors—for instance, a user may list their
university or corporate email as the recovery email for their primary personal
email account, and later leave the university or company. Google reported in
2018 that 10% of users fail email or SMS 2FA (Milka, 2018) (e.g., if they no
longer have access to the recovery email), though providers attempt to
mitigate this by regularly reminding users which recovery options they have
set.

####  A.0.3. Authenticator App

Mobile authenticator apps (e.g., Duo Mobile, Microsoft Authenticator) have
seen low adoption among the general public (Milka, 2018; Golla et al., 2021;
Petsas et al., 2015) but are frequently mandated in university settings
(Abbott and Patil, 2020; Reynolds et al., 2020) or by a small number of
security-sensitive providers (e.g., Github (John Swanson, 2022)). Academic
usability research has found that MFA apps are generally considered easy to
use (Colnago et al., 2018; Abbott and Patil, 2020; Dutson et al., 2019) but
that users perceive the extra step required by MFA as a nuisance (Das et al.,
2020; Marky et al., 2022; Reynolds et al., 2020; Abbott and Patil, 2020; De
Cristofaro et al., 2013). MFA apps are widely supported among the top domains
(Quermann et al., 2018).

Recovery from App Loss: After several years of widespread 2FA app deployment,
the academic community has begun to investigate the consequences of app loss
(which can frequently occur as a result of device reset, loss, or theft, or
because the app backup not including as part of larger device cloud backup).

User concerns over device loss have been a frequent theme with app-based 2FA.
Every widely used 2FA app offers different backup and recovery options (Max
Eddy), 2024). Several offer cloud backups with iCloud, Google Drive, and
sometimes other cloud services, and encrypts backups with a user-chosen
password. Others use “backup codes” which the user is responsible for storing,
and which are easily lost, or offer users the option of backing up to another
device via QR code (Gilsenan et al., 2023).

Prior work has found that recovery is a weak point for 2FA apps that
undermines the security mobile app authentication is intended to provide by
resorting to the usual array of fallback authentication mechanisms: SMS,
email, passwords, and manual recovery (Gilsenan et al., 2023; Gerlitz et al.,
2023). A spate of recent work has focused on the consequences of losing access
to a two-factor authentication (2FA) mechanism, a common scenario for users
who use a mobile app for 2FA and a recipe for disaster as mobile devices are
regularly lost, changed, damaged, or stolen. Gerlitz et al. (Gerlitz et al.,
2023) studied how service providers respond to users losing a 2FA mechanism.
In 2023, they created accounts at 78 popular websites or mobile apps using 2FA
to see what recovery information, if any, was described to the user. They
conclude that not enough attention is given to recovery, with 28 of 78
services studied not mentioning anything during the setup phase what backup or
recovery procedures, if any, might exist. Amft et al. (Amft et al., 2023b)
went a step further and analyzed real-world deployments of multi-factor
authentication on 71 websites, contacting the sites through public email
addresses, support forms as though they were a user who had lost their second
factor and going through the manual account recovery process. They found
significant variation and inconsistencies among sites, including discrepancies
between a given site’s documentation and actual procedures. Accounts on 10 of
71 sites were recovered simply by providing specific knowledge about the
account that only the real account owner would know, while 13 sites required
some form of official real-world identification, such as a government ID, to
regain access. All in all, the authors identify 17 distinct recovery
procedures and conclude that they “could not identify best practices regarding
MFA recovery procedures” due to the variety.

Gilsenan et al. (Gilsenan et al., 2023) studied backups of two-factor
authentication apps that use time-based one-time passwords (e.g., a six-digit
code that a user has 30 seconds to provide to a platform), finding commonly
shared flaws in backup security, such as that the one-time password data is
backed up in plaintext or that SMS is used to authenticate to the backup. The
scope of all prior work in 2FA generally assumes two points: (1) that the user
recalls or has access to the backup password and only the second factor is
lost, and (2) that manual recovery is a possibility since the provider has the
ability to reset or remove MFA.

####  A.0.4. Hardware Tokens

The well-known weaknesses of authentication flows that rely solely on
passwords has motivated the adoption of 2FA technology. However, SMS-based 2FA
(Section A.0.2) remains vulnerable to SIM swapping and authenticator apps
(Section A.0.3) do not protect against live phishing attacks. Hardware tokens
that perform interactive cryptographic protocols with the online service
address these issues.

Today, most hardware-based authentication protocols are based on the
specifications provided by the FIDO Alliance, which many large companies are
part of. The Universal Second Factor (U2F) protocol (FIDO Alliance, 2024b)
allows for interoperable hardware tokens that can provide an authentication
proof to different web services. This additional factor is typically only
requested when the user logs in for the first time on a new device.

When registering at a new web service, the client (e.g. the browser) provides
the hardware token with origin information that include the domain name. The
hardware token then creates a fresh public-private key pair in its secure
memory and derives a key handle based on the origin information. Both the
public key and the key handle are then passed through the client to the web
service.

For later authentication, the web service provides the key handle and a
challenge to the client which passes it together with the origin information
to the hardware token. The hardware token first verifies that the key handle
and origin match. This prevents other web service from tricking the user to
authenticating on a phishing website. In a second step, the hardware token
signs the challenge with the stored private key which the website can verify
using the public key.

Hardware tokens typically perform a simple test of user presence by requiring
a simple button press on the device. This ensures that each authentication
attempt is known to the user and a malicious app cannot perform authentication
requests in the background. Web services can use the attestation keys provided
by the hardware tokens to ensure that the user is using a device that fulfills
certain certification standards. (FIDO Alliance, 2024b)

From a usability standpoint, academic work has shown repeated concerns over
account lockout upon device loss (Ciolino et al., 2019; Reynolds et al., 2018;
Das et al., 2018; Farke et al., 2020), in addition to general annoyance over
the hassle of having to carry and retrieve an additional physical component,
which is often reflected in high login timeout or cancellation rates (Ciolino
et al., 2019; Reynolds et al., 2020). Difficulty of account sharing is another
significant concern with hardware tokens (Reynolds et al., 2018).

####  A.0.5. Risk-Based Authentication

While not traditionally considered a second-factor since metadata is often
unwittingly provided by the user, risk-based authentication (RBA) is a
critical strategy providers deploy to distinguish legitimate logins from
nefarious access (Wiefling et al., 2019; Freeman et al., 2016). RBA broadly
refers to any technical strategy that protects against illicit account access
but does not require any information from the user, most commonly asking users
to verify their email address (Büttner et al., 2023). Providers have long
resorted to using metadata indicators to determine whether a recovery attempt
is legitimate, though high failure rates of 2FA (even basic email and SMS 2FA)
(Milka, 2018) require companies to carefully balance which logins should be
considered suspicious. Broadly, services use an immense variety of mitigation
strategies, including throttling (limiting the number of guessing attempts),
previously-seen IP addresses, geolocation data, or other metadata available
from browser fingerprints (Grassi et al., 2020; Milka, 2018; Wiefling et al.,
2019; Freeman et al., 2016; Wu et al., 2023b; Durey et al., 2021; Senol et
al., 2024), and sometimes even monitoring users’ behavior post-login (Grosse
and Upadhyay, 2012). Typically, additional verification steps are only
deployed if an authentication attempt is deemed suspicious based on the
particular metrics and statistical framework used by the account provider.

Both Apple and Google rely heavily on the concept of trusted devices, where
logged-in devices are sent a notification to confirm any additional access
attempts flagged as suspicious (Mark Risher, 2021; Milka, 2018), though this
is only relevant when multiple devices are connected to an account. Temporal
lockouts, where the user needs to wait a certain period after a correct
authentication, are commonly deployed in recovery schemes. For instance, as
early as 2008 Gmail only allowed account recovery through recovery questions
if the account in question had not been accessed in the past five days (Ed
Felten, 2024). Today, Google deploys temporal lockouts as part of the manual
recovery process to ensure a legitimate user has a chance to deny the request
(Google, 2024c), though research has shown users often fail to recognize
malicious sign-in attempts (Markert et al., 2024).

RBA is almost always deployed as an additional authentication measure on top
of a pre-existing primary authentication scheme, most commonly in addition to
standard password-based authentication (Wiefling et al., 2022, 2020). Prior
work has shown it is possible to evade many RBA measures using various
cloaking techniques (Andriamilanto et al., 2021; Oest et al., 2019; Mirian et
al., 2019; Oest et al., 2020; Campobasso and Allodi, 2020; Lin et al., 2022).

##  Appendix B Additional Authentication Schemes

####  B.0.1. Biometric Authentication

Finally, a commonly floated approach is for a user to provide some element of
their real-world identity to the service provider, such as biometric data.
While biometrics are certainly the most resilient form of user authentication,
this form of data raises numerous questions around privacy and accuracy. As
with recovery questions, biometrics are often used as a component of a multi-
factor authentication process, such as unlocking a mobile device with Face ID
when a user has also demonstrated physical possession of the device. However,
with regular end-user hardware, we believe are not suitable as a standalone
authentication factor for a cloud-based service.

In the last years, new attempts have been undertaken to bridge the gap to
allow identifying individuals on a global scale. One example is the Orb
technology that is being deployed as part of the Worldcoin project (Worldcoin
Foundation, 2024). The project deploys proprietary hardware and algorithms in
order to achieve unique global identification of individuals with very low
false-positive and false-negative rates. One use-case is to provide strong
“proof of personhood” (and therefore sybill resistance) for Web3 services even
where users do not have access to other means identification such as
government issued IDs.