A World with Many Authentication Schemes

Usability and security challenges with standard text passwords have led researchers and professionals to consider alternative authentication schemes. This thesis explores the various challenges inherent in supporting a practical reality of authentication scheme diversity. We address these challenges by proposing the following solutions aimed at providing users with a usable and secure authentication experience through alternative schemes. We developed a framework for developers, researchers, professionals, and users to identify and compare the user-centred features that may be supported by authentication schemes. We also performed empirical studies on two novel authentication schemes. We demonstrate that our text-based password scheme, Persuasive Text Passwords, can influence users to create more secure passwords that are memorable. We also show that our gaze-based graphical password scheme, Cued Gaze-Points, is usable and may offer resistance against shoulder-surfing attacks at the cost of reduced resistance against password guessing attacks. Furthermore, we built and user tested four different tutorial formats to determine which is most effective at teaching users a novel authentication scheme. Finally, we designed Choose Your Own Authentication (CYOA); an architecture that enables users to choose an authentication scheme amongst several available alternatives. CYOA provides numerous benefits to end-users, as well as security administrators who manage the back-end portion of the authentication, and researchers who develop novel authentication technologies. Finally, we discuss the design of a usability study of CYOA, to evaluate how users will leverage and cope with the power of choice between authentication schemes.