Quantifying costs of enhanced security in multifactor authentication

Seth Hastings, Tyler Moore, Neil Gandal and Noa Barnir

No 18701, CEPR Discussion Papers from Centre for Economic Policy Research

Abstract: Multifactor authentication (MFA) is one of the most important security controls, topping most lists of cyber hygiene activities advocated by experts. While the security benefits may be substantial, less attention has been paid to the impact on users by the added friction introduced by the more stringent precautions. In this paper, we construct and analyze a dataset of authentication logs from a University population spanning two years. We focus on opportunity costs experienced by users: (1) log-in failures and (2) the time spent away from IT applications following a failed authentication before attempting to re-authenticate. The second measure captures how user frustration can manifest by avoiding or delaying future engagement after experiencing failures. Following an exogenous change in MFA policy from a deny/approve mobile notification to a more cumbersome two-digit code mobile notification confirmation, we show that there are significant increases in the number of log-in failures and in time spent away following failures when using mobile MFA. We also briefly examine which types of users had the greatest difficulty adjusting to the more secure mobile MFA procedure. Forthcoming, 2025, Information Systems Frontiers We gratefully acknowledge support from the US National Science Foundation (NSF) Award No. 2147505 and Award No. 2452738 and the US Israel Binational Science Foundation (BSF) Award No. 2021711. We thank the editor and two referees whose comments and suggestions greatly improved the paper. We also thank seminar participants at Boston University, Hebrew University, and the Politecnico in Milano for helpful comments and suggestions.

JEL-codes: D00 (search for similar items in EconPapers)
Date: 2023-12
References: Add references at CitEc
Citations:

Downloads: (external link)
https://cepr.org/publications/DP18701 (application/pdf)

Related works:
Journal Article: Quantifying Costs of Enhanced Security in Multifactor Authentication (2026)
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:cpr:ceprdp:18701

Ordering information: This working paper can be ordered from
https://cepr.org/publications/DP18701

Access Statistics for this paper

More papers in CEPR Discussion Papers from Centre for Economic Policy Research 33 Great Sutton Street, London EC1V 0DX, UK.
Bibliographic data for series maintained by CEPR ().