The FIDO2 protocol, developed by the FIDO ("Fast IDentity Online") Alliance, allows users to authenticate securely via single-factor passwordless authentication. While FIDO2 eliminates the need for creating/managing passwords across multiple accounts and is secure against several known vulnerabilities that make password-based authentication systems susceptible to security attacks (e.g., phishing attacks, keylogging), prior efforts have noted users’ reluctance to adopt FIDO2. This work investigates whether this reluctance could be addressed by communicating a technical explanation and the benefits of FIDO2 authentication. Towards that, we conduct a 2x2 between-subjects study on a sample size of n = 85, showing each group a subset of videos explaining different aspects of the technology. After watching the videos, we assess participants’ understanding of the technology and their perception of FIDO2’s usability and security benefits via an anonymous survey. We find that explicitly communicating technological information and/or security benefits does not influence participants’ intention to adopt it and fails to mitigate users’ usability concerns regarding the technology. Interestingly, once we group the participants based on self-reported intention to adopt FIDO2, we find that participants who intend to adopt significantly differ in terms of perceived risk perception, self-efficacy, response efficacy, and response cost (i.e., inconvenience). This underscores the importance of risk communication and self-efficacy development which are more likely to influence participants’ intention to adopt the technology. The implications of our findings are discussed in the paper.

Prior efforts have identified different reasons such as perceived inconvenience due to task interruptions, past bad experiences associated with updating, and/or a perceived lack of importance for declining software updates. However, these do not fully explain why some users comply with update recommendations (i.e., update compliers) while others postpone them (i.e., update postponers). To investigate the factors contributing to this difference, we recruited 283 participants on the Amazon Mechanical Turk platform and conducted a study using Microsoft Windows as the context. Our results suggest that update characteristics (e.g., restart required vs. not required, security vs. performance updates) are not correlated with users’ intentions to perform Windows updates or postpone them. Instead, we found that trust-based heuristics play a significant role in the update decision-making process. Notably, participants who indicated to update their systems exhibited a higher level of cognitive dissonance, indicating psychological discomfort associated with updating their systems. The paper discusses the implications of these findings and offers design recommendations to promote software update behavior while reducing cognitive dissonance.

This paper investigates how trust towards service providers and the adoption of privacy controls belonging to two specific purposes (control over “sharing” vs. “usage” of data) vary based on users’ technical literacy. Towards that, we chose Google as the context and conducted an online survey across 209 Google users. Our results suggest that integrity and benevolence perceptions toward Google are significantly lower among technical participants than non-technical participants. While trust perceptions differ between non-technical adopters and non-adopters of privacy controls, no such difference is found among the technical counterparts. Notably, among the non-technical participants, the direction of trust affecting privacy control adoption is observed to be reversed based on the purpose of the controls. Using qualitative analysis, we extract trust-enhancing and dampening factors contributing to users’ trusting beliefs towards Google’s protection of user privacy. The implications of our findings for the design and promotion of privacy controls are discussed in the paper.