Designing Usable, yet Secure Authentication Services: A User-Centric Protocol.
Résumé
User authentication is key in many interactive tourism software applications and Websites including online booking and reservation applications, customer relationship management systems, etc. However, the design of a user authentication service raises crucial questions when it comes to properly balancing between security and usability. Furthermore, there is a common false design belief that security is only related to the underlying software functionality and can be designed independently from the usability which is related to the User Interface (UI) component and the user experience, in our context the tourist. Finding the right trade-off between these two quality attributes is not an easy endeavour. In this paper, we introduce a new cognitive model that aims to model the tourist task when using a user authentication system. This can help security designers to specify, design, inspect, and evaluate the security as well as usability aspects of user authentication mechanisms. Our model integrates usable security concerns earlier into the requirements and design phase of the development lifecycle. We also show how the proposed model contributes to usable security in a real-world application based on a Multifunction Teller Machine (MTM)