M. Angela Sasse, Michelle Steves, Kat Krol and Dana Chisnell


We conducted a two-part study to understand the impact of authentication on employees’ behaviour and productivity in a US governmental organisation. We asked 23 participants to keep a diary of all their authentication events within a 24-hour period, and subsequently interviewed them about their experience with authentication. We found that the authentication tasks employees have to perform not only carry significant workload, but that the way in which authentication disrupts primary tasks reduces productivity and creates frustration. Our participants reported a range of coping strategies, including use of tools and re-organising their work to avoid security. Avoidance meant they logged in less frequently, stopped using certain devices and services. They also reported not pursing innovative ideas because of “the battle with security” that would be required. Our case study paints a picture of chronic ‘authentication fatigue’ resulting from current policies and mechanisms, and the negative impact on staff productivity and morale. We propose that organisations need to urgently re-think how they authenticate users in a pervasive technology requirement, and advocate a paradigm shift from explicit to implicit authentication. Keywords: Authentication, usable security, productivity, workload, diary study Date: June 26, 2014 Presented: Cross-Cultural Design 6th International Conference, CCD 2014, Held as Part of HCI International 2014, Heraklion, Crete, Greece, June 22-27, 2014 Published: Lecture Notes in Computer Science Volume 8528, 2014, pp 228-239. Publisher: Springer ISBN: 978-3-319-07307-1 (Print) 978-3-319-07308-8 (Online) Publisher URL: http://link.springer.com/chapter/10.1007/978-3-319-07308-8_23 Full Text: http://link.springer.com/content/pdf/10.1007%2F978-3-319-07308-8_23.pdf