CAREER: SaTC: Towards a Science of Passwordless Authentication

Online authentication is crucial for protecting users' accounts and data online. For decades, online authentication has relied upon passwords. However, passwords have widely-recognized security and usability issues. These concerns have driven the creation of passwordless authentication approaches, including promising methods like Fast IDentity Online 2 (FIDO2) that have already seen notable initial deployment by popular browsers, devices, and online services. FIDO2 uses cryptography instead of passwords to support authentication, and offers desirable security and usability properties. Given that these technologies are still relatively new and quite different from password-based authentication, it is unclear how both users and online services will act as they move toward using passwordless authentication, and what unexpected security and usability issues may arise. This project seeks to understand how passwordless authentication will manifest in practice, as well as the emergent security or usability problems with it. The project will also produce solutions for addressing these concerns, which are particularly important to develop before passwordless authentication is more broadly deployed. The project also includes a substantial educational effort to introduce authentication-related computer security topics to high school students. Ultimately, this project will expand the knowledge of online authentication and security, and support the transition to a secure and user-friendly passwordless future. As authentication is fundamentally a human-driven task, this project will apply a hybrid approach combining user-driven studies, web measurements, and system design. The technical aims of this project are divided across three integrated tasks that consider both end users and online services. The first task will systematically investigate passwordless adoption dynamics, monitoring real-world adoption behavior and illuminating socio-technical barriers to adoption. The second task will evaluate the security and usability implications of real-world passwordless behavior once adopted, particularly at scale (considering passwordless use across multiple devices and online services, as well as by all user populations). The third task will systematize the insights gained from the earlier tasks, producing system and design principles for passwordless authentication. It will then apply these principles to develop socio-technical solutions to address emergent adoption, security, and usability issues with passwordless authentication, and improve its use in practice. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.