On the Usability of Next-Generation Authentication: A Study on Eye Movement and Brainwave-based Mechanisms

TL;DR

This study evaluates the usability of eye movement and brainwave-based authentication methods through empirical user testing, revealing their strengths, privacy concerns, and areas for design improvement.

Contribution

It provides an empirical comparison of brainwave and eye movement authentication mechanisms, highlighting usability, security perceptions, and privacy issues.

Findings

Both mechanisms have good usability scores (78.6-79.6 SUS).

Brainwave authentication perceived as more secure but more privacy-invasive.

Participants desire more information on security and privacy implications.

Abstract

Passwords remain a widely-used authentication mechanism, despite their well-known security and usability limitations. To improve on this situation, next-generation authentication mechanisms, based on behavioral biometric factors such as eye movement and brainwave have emerged. However, their usability remains relatively under-explored. To fill this gap, we conducted an empirical user study (n=32 participants) to evaluate three brain-based and three eye-based authentication mechanisms, using both qualitative and quantitative methods. Our findings show good overall usability according to the System Usability Scale for both categories of mechanisms, with average SUS scores in the range of 78.6-79.6 and the best mechanisms rated with an "excellent" score. Participants particularly identified brainwave authentication as more secure yet more privacy-invasive and effort-intensive compared to eye movement authentication. However, the significant number of neutral responses indicates participants' need for more detailed information about the security and privacy implications of these authentication methods. Building on the collected evidence, we identify three key areas for improvement: privacy, authentication interface design, and verification time. We offer recommendations for designers and developers to improve the usability and security of next-generation authentication mechanisms.