The Mobile Paradox: How Interface Friction Can Improve 2FA Security

About this work

Abstract

This paper examines how the mobile interaction context affects the security and usability of compare-and-confirm two-factor authentication under a first-factor-compromise threat model. Using a controlled within-subjects study with 65 participants and 24 trials per participant, it compares benign and attack decisions when authentication is performed across a PC and phone versus entirely on a phone. The analysis focuses on decision correctness and response time, asking whether the extra friction introduced by small screens and app switching can encourage more deliberate verification. The findings illustrate a security-usability paradox in which some interface friction can slow authentication while also supporting more careful security decisions.