Can Unicorns Help Users Compare Crypto Key Fingerprints?
summary
A 661-participant online experiment compares eight fingerprint representations and two modes under a simulated 2^60 attacker and finds big differences: textual sentences produce the best security with a 6% miss rate, while compare-and-select fails badly at 72% missed attacks. Unicorn avatar fingerprints have over 50% misses; visual hostkey and bash miss ~10–12%. Graphical designs take 2–5 seconds to compare vs 7–8 for text. Recommendation: avoid manual compare when possible and avoid compare-and-select.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:29End-to-end encrypted messaging
- 1:21Attack scenario
- 2:12Public key
- 2:33Key verification
- 3:16Can users discern similar fingerprints?
- 3:43Fingerprint representations
- 4:14Comparison modes
- 4:45Research questions
- 5:50Methodology
- 6:23Realistic comparison conditions
- 7:39Textual representations
- 8:03Graphical representations
- 9:13Simulated attack
- 10:06Attack strategy
- 10:59Measuring security & efficiency
- 11:13Textual had similar security
- 11:56Compare-and-select caused more mistakes
- 12:49Recommendations
related talks
23mAn Empirical Study of Textual Key-Fingerprint Representations
24mOf Two Minds about Two-Factor: Understanding Everyday FIDO U2F Usability
22mA Usability Study of Five Two-Factor Authentication Methods
10mChasing Unicorns: A Lovable Security Story
09mCredential Format Comparison SIG
06mOptimizing Shoulder-Surfing Resistance in Augmented and Virtual Reality
19mWeakest Link
21mFp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies