Understanding Authentication Method Use On Mobile Devices .

Understanding Authentication Method Use onMobile Devices by People with Vision ImpairmentDaniella Briotto Faustino and Audrey GirouardCarleton UniversityOttawa, ON, Canadadaniella.briottofaustino@carleton.ca, audrey.girouard@carleton.caABSTRACTPasswords help people avoid unauthorized access to theirpersonal devices but are not without challenges, likememorability and shoulder surfing attacks. Little is knownabout how people with vision impairment assure their digitalsecurity in mobile contexts. We conducted an online surveyto understand their strategies to remember passwords, theirperceptions of authentication methods and their self-assessedability to keep their digital information safe. We collectedanswers from 325 people who are blind or have low visionfrom 12 countries and found: most use familiar names andnumbers to create memorable passwords, the majorityconsider fingerprint to be the most secure and accessible userauthentication method and PINs the least secure userauthentication method. This paper presents our survey resultsand provides insights for designing better authenticationmethods for people with vision impairment.Author KeywordsBlind; low vision; vision impaired; password; userauthentication methods; smartphones; mobile devices.ACM Classification KeywordsSecurity and privacy Human and societal aspects ofsecurity and privacy Usability in security and privacyINTRODUCTIONCurrently, there is little information about security for peoplewith vision impairment while interacting with mobiledevices [22]. People with vision impairment are those whoare blind in one or both eyes, or those who have low visionand cannot read a newspaper even when wearing typicalcorrective lenses [33]. Previous research showed themajority of people with vision impairment did not useauthentication methods to protect their smartphones becausethey considered the alternative available (PINs) eitherinaccessible or inconvenient [7, 17]. In addition, researchersfound accessibility issues in authentication with ATMs [13],Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies arenot made or distributed for profit or commercial advantage and that copiesbear this notice and the full citation on the first page. Copyrights forcomponents of this work owned by others than the author(s) must behonored. Abstracting with credit is permitted. To copy otherwise, orrepublish, to post on servers or to redistribute to lists, requires priorspecific permission and/or a fee. Request permissionsfrom Permissions@acm.org.ASSETS '18, October 22–24, 2018, Galway, Ireland 2018 Copyright is held by the owner/author(s). Publication rightslicensed to ACM.ACM ISBN 978-1-4503-5650-3/18/10 As [31], and patterns drawn on the screen [8]. Also,people with vision impairment are more vulnerable toshoulder surfing and aural eavesdropping when enteringPINs [20]. However, even though more user authenticationmethods are now available (e.g. fingerprint and facialrecognition), we do not have information about which of theexisting methods people with vision impairment considermore secure, more accessible or preferable.In 2015, Bourne et al. [12] estimated that 36 million peoplewere blind and 217 million were moderately or severelyvision impaired, for a total of 253 million people living withvision impairment around the world. Thanks to the rise ofaccessibility features and applications for mainstreamdevices, the number of people with vision impairment usingsmartphones is increasing [14, 20]. Consequently, they arerelying more on the technology, making it essential to assuretheir privacy and security protections [22].To better understand how people with vision impairmentperceive and navigate user authentication methods, weconducted a comprehensive online survey to answer thefollowing research questions:1) How do people with vision impairment self-assess theirability to keep their digital data secure?2) Which is the user authentication method considered moresecure and accessible for people with vision impairment?3) What are the differences between people who are blindand people who have low vision in their preference andopinion on user authentication methods?To the best of our knowledge, this study is the first toextensively explore the relationship people with visionimpairment have with passwords and user authenticationmethods. Through an analysis of the answers from 325 visionimpaired respondents, the contributions of this work are: (1)an overview of the main challenges faced by people withvision impairment when dealing with passwords; (2) insightson how people with vision impairment perceive differentuser authentication methods; (3) a comparison betweenpeople who are blind and people who have low visionregarding digital security.This paper starts with Related Work centered around userauthentication methods and security concerns for peoplewith vision impairment on a mobile context. SurveyMethodology describes the development and distribution of

the online survey, while the Results reports on participants,password use, authentication methods in mobile devices, anduse of smartphones and authentication. Discussion weightsthe most important findings and how they relate withprevious work.RELATED WORKIn 2016, 77% of sighted adults from the United States ofAmerica (US) said they own a smartphone, a large increasefrom 2011 where the percentage of smartphone owners was35% [30]. With the increase in smartphone adoption, morepersonal data is stored in them, such as name, address, emailand geolocation [22]. To protect smartphones fromunauthorized access (and consequently the personalinformation saved in them), users have to prove they are whothey are claiming to be, through a user authentication method[25]. The methods available can be categorized as:something you know (knowledge-based, such as PINs,alphanumeric passwords or patterns drawn on the screen),something you have (token-based, such as smart cards), andsomething you are (biometric-based, such as fingerprints,facial recognition, voice recognition, iris scans) [22]. Theoptions most commonly used by sighted Americans werePINs (26%), fingerprint (23%), passwords (9%), and patterns(9%), but 28% did not use any method to lock their screenand avoid unauthorized access [30].Besides from being the most ubiquitous option, PINs areconsiderably more secure than patterns, as even a 2-digit PINis most secure than a pattern of dots connected by drawingon the screen, because people tend to create very simplepatterns [4]. On the other hand, both PINs and alphanumericpasswords require users to memorize a sequence ofcharacters, a disadvantage when compared to biometricmethods. Fingerprints, for instance, allow for a reliableindividual identification [11], though they have issues, suchas high false rejection rates, and the impossibility ofreplacing one’s fingerprint in case the information iscompromised [25]. Ultimately, biometrics does not replacepasswords, and “can be considered a re-authenticator or asecondary-authentication device as a user is still required tohave a PIN or pattern that they enter rather frequently due toenvironmental impacts (e.g., wet hands)” [5].Smartphones are powerful devices, offering a myriad offunctions and access to different social spheres, but for theblind or vision-impaired user, they are limited by theubiquity of touch screen interfaces [15]. Blind individualscan explore the UI elements on their touch screen with thesupport of embedded screen readers, even though this is aslow and error-prone process [6]. This extends to security,where typing PINs while using screen readers makes peoplewith vision impairment more susceptible to others listeningtheir passwords (aural eavesdropping), as the system readsout loud everything, even password entries [20]. Similarly,the use of screen magnifiers by those with low vision alsoincreases the susceptibility for visual eavesdropping [20]. Inaddition, trying to type in a password is considered one ofthe most difficult things for people with vision impairmentto do in a smartphone while using the internet [9].Prior work from Ahmed et al. [2] indicates that most peoplewith vision impairment feel uncomfortable to use passwordsin public contexts for fear of eavesdropping and also haveprivacy concerns. However, other research indicate that themajority of people with vision impairment are choosing notto use passwords to protect their smartphones [7, 17]. One ofthe reasons given by participants for not using anyauthentication method was that they kept their smartphoneclose to them at all times [7, 38], even though this is not asecure practice. Another reason mentioned by someparticipants was the inconvenience of unlocking the deviceusing PINs [7], potentially due to the penalty in time [36].Additionally, among the user authentication methodscurrently available on smartphones, iris or retina scans canbe problematic for people with vision impairment, “who mayhave deformed or missing eyes, or no ability to open theireyelids” [22], as patterns drawn on the screen are, becausethey require the selection of points on the touch screen [8,22].It is important to realize that users see security simply as ameans to complete their tasks while having their data private.However, if security features are not accessible to them, iteither makes them unable to access specific information orapplications, or forces them to ask the help of others whilecompleting required authentication procedures, possiblycompromising their own security [22]. Prior research on theintersection of usability, security and accessibility are rare[31] and need further investigation [22]. This work aims toclarify both whether people with vision impairment arecurrently adopting user authentication methods and whetherthese pose accessibility issues to them.SURVEY METHODOLOGYWe developed an online survey to collect data from blind andlow vision individuals regarding their use of passwords andperceptions about user authentication methods and their ownability to protect their personal information in digitaldevices. Our hypotheses were:H1) People with vision impairment will not feel able toproperly keep their digital information secure, because ofaccessibility issues with the visual cues and feedbackprovided [7] and the difficulty to assess if others are shouldersurfing their passwords [2].H2) People with vision impairment will choose fingerprintsas the most secure authentication method due to its broad use[30]. They will also choose it as the most accessible methodas it is a biometric method, which does not require enteringa password and is available in most smartphones [26].H3) As to the best of our knowledge no previous workinvestigated differences in preference and opinions regardingauthentication methods between people who are blind andpeople who have low vision, we expect no differencebetween the two groups.