DuoLungo: Usability Study of Duo 2FA
This paper presents a large-scale usability study of Duo 2FA at UC Irvine involving 2,559 participants, revealing that while the system achieves a good usability score (70) and enhances perceived security, it incurs an average 8-second login overhead and a notable failure rate that varies by user demographics and time of day.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you have a very secure house. To get in, you don't just use a key (your password); you also have to show a special ID card to a guard (the second factor). This is called Multi-Factor Authentication (MFA). One of the most popular guards in the world is a company called Duo.
This paper is like a long-term "report card" for Duo, written by researchers at the University of California, Irvine (UCI). They watched over 2,500 students and staff use Duo for nine months to see how easy, annoying, or secure it actually is in real life.
Here is the breakdown of their findings, using simple analogies:
1. The "Wait Time" (Overhead)
The Finding: On average, it takes a user about 7.8 seconds to complete a Duo login.
The Analogy: Think of this like waiting for a traffic light to turn green. It's not a long commute (like waiting 5 minutes), but it's not instant either. It's a "short-to-moderate" pause.
The Details:
- Time of Day Matters: Just like traffic gets worse during rush hour, Duo takes longer to process in the early morning (5 AM – 9 AM) and late at night.
- Who You Are Matters: Graduate students took slightly longer than freshmen. It's like how a new driver might take a few extra seconds to check their mirrors compared to a veteran driver who does it on autopilot.
- Major Matters: Students studying Computer Science were generally faster than those in other fields, likely because they are more tech-savvy.
2. The "Broken Gate" (Failures)
The Finding: About 4.35% of the time, the login fails even if the user has the right password. In the survey, nearly 44% of people said they had failed at least once.
The Analogy: Imagine you have the right key and the right ID, but the guard's radio is broken, or you forgot to bring your ID card home.
The Main Culprit: The biggest reason for failure (85% of them) was Timeouts. The user didn't click the "Approve" button on their phone fast enough, or the notification never arrived. It's like the guard waving at you, but you were looking at your shoes and missed the signal.
Other Issues: Sometimes people lost their phones, couldn't get a signal, or their account was locked.
3. The "Love-Hate" Relationship (User Feelings)
The Finding: Duo got a System Usability Scale (SUS) score of 70. On a scale of 0 to 100, this is a "Good" rating.
The Analogy: Think of Duo like a seatbelt.
- The Good: Everyone agrees it keeps you safe. 77% of people felt much more secure knowing their accounts were protected.
- The Bad: Everyone agrees it's annoying. People find it "easy" to use, but also "annoying" to have to do it every time.
- The Verdict: It's a necessary evil. You don't love putting on a seatbelt, but you're glad it's there when you need it.
4. The "Code" vs. The "Push"
The Finding: Duo has two ways to log in:
- Push Notification: A pop-up on your phone asking "Approve?" (Most people use this).
- Passcode: A 6-digit number you type in manually.
The Analogy: The Push is like a doorbell (just press the button). The Passcode is like typing a combination lock.
- People found the "doorbell" (Push) easy and quick.
- People found the "combination lock" (Passcode) much more annoying and frustrating, especially if they had to type the code multiple times in a row.
5. What People Wanted to Change
The researchers asked users for suggestions, and here is what they heard:
- "Remember Me": People are tired of logging in 3-4 times a day. They want the system to remember their device for a while so they don't have to jump through hoops every single time.
- Offline Mode: If you are on an airplane or in a basement with no Wi-Fi, you can't get the push notification. People want a way to log in without the internet.
- Better Notifications: Sometimes the "Approve" button on the notification doesn't work, forcing you to open the full app. People want the button to work instantly.
Summary
The paper concludes that Duo is a reliable, secure, and generally easy-to-use guard, but it can be frustrating when it fails or when you have to use it too often. It's not perfect, but it's doing a "Good" job at keeping your digital house safe. The researchers suggest that if Duo adds a few more "smart" features (like remembering devices or working offline), it could turn that "Good" rating into an "Excellent" one.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.