Usability and Security Analysis of the Compare-and-Confirm Method in Mobile Push-Based Two-Factor Authentication

About this work

Abstract

This paper evaluates the security and usability of push compare-and-confirm authentication, where users verify that a code shown on the login terminal matches the code in a mobile push notification. A 65-participant study examines benign and adversarial logins in two settings: a PC with a separate phone and a phone acting as both the login terminal and second-factor device, with four- and six-character codes. Benign approvals remained very high, but participants detected only about half of fraudulent attempts. The results show that number matching improves on simple push approval yet still leaves substantial room for false approvals, motivating clearer interfaces, stronger contextual cues, and complementary defenses.