Investigation of the security and usability of visual and verbal public key fingerprint verification methods

Modern end-to-end-encrypted (E2EE) applications include an optional key fingerprint verification which allows users to establish the authenticity of a received key, and provide assurance that all subsequent communication is confidential. An under-explored aspect is the impact of verification mode upon user performance and perceived usability. Key fingerprints can be verified either visually or verbally, which present very different tasks to the user. Modern applications tend to support verification using a verbal verification, yet previous research has largely investigated visual verification. Users may also possess a pre-existing preference in how they prefer to process auditory–visual information, which may in turn affect their performance. This thesis reports the results of a systematic investigation of the impact of verification mode upon user performance and perceived usability, with the evidence suggesting that visual verification is more efficient and provides increased usability. A robust usability effect was observed, with participants found to make more non-attack errors when using both word-based and numerical fingerprints. A surprising result was the absence of a security effect related to effectiveness, with participants found to be proficient in identifying non-identical attack fingerprints. The impact of a participant’s auditory–visual information processing preference was also not significant, with the impact of verification mode instead appearing to be the dominant factor. These results demonstrate the advantages in providing users the option to verify fingerprints visually. Visual verification appears to provide reduced ambiguity about the correctness of a received fingerprint, and though information processing preference was not found to be an indicator of performance, participants did report a clear preference for use of a visual verification mode. This should motivate E2EE applications to increase their support for utilisation of a visual verification, for those users who prefer to use it.