Performance and Usability of Visual and Verbal Verification of Word-based Key Fingerprints

TL;DR

This study compares the performance and usability of visual versus verbal verification of word-based key fingerprints, revealing visual methods are more effective for security, while verbal methods are perceived as easier.

Contribution

It provides empirical evidence on the effectiveness and user perception of visual and verbal fingerprint verification methods, including the influence of learning styles.

Findings

Visual comparison reduces non-security errors.

Participants perceive verbal verification as easier.

Limited evidence on learning style impact.

Abstract

The security of messaging applications against person-in-the-middle attacks relies on the authenticity of the exchanged keys. For users unable to meet in person, a manual key fingerprint verification is necessary to ascertain key authenticity. Such fingerprints can be exchanged visually or verbally, and it is not clear in which condition users perform best. This paper reports the results of a 62-participant study that investigated differences in performance and perceived usability of visual and verbal comparisons of word-based key fingerprints, and the influence of the individual's cognitive learning style. The results show visual comparisons to be more effective against non-security critical errors and are perceived to provide increased confidence, yet participants perceive verbal comparisons to be easier and require less mental effort. Besides, limited evidence was found on the influence of the individual's learning style on their performance.