{"id":"https://openalex.org/W4405907147","doi":"https://doi.org/10.1109/tmc.2024.3524093","title":"Usability and Security Analysis of the Compare-and-Confirm Method in Mobile Push-Based Two-Factor Authentication","display_name":"Usability and Security Analysis of the Compare-and-Confirm Method in Mobile Push-Based Two-Factor Authentication","publication_year":2024,"publication_date":"2024-12-30","ids":{"openalex":"https://openalex.org/W4405907147","doi":"https://doi.org/10.1109/tmc.2024.3524093"},"language":"en","primary_location":{"id":"doi:10.1109/tmc.2024.3524093","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tmc.2024.3524093","pdf_url":null,"source":{"id":"https://openalex.org/S69141925","display_name":"IEEE Transactions on Mobile Computing","issn_l":"1536-1233","issn":["1536-1233","1558-0660","2161-9875"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Mobile Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5025768266","display_name":"Mohammed Jubur","orcid":"https://orcid.org/0000-0001-9398-3875"},"institutions":[{"id":"https://openalex.org/I91450128","display_name":"Jazan University","ror":"https://ror.org/02bjnq803","country_code":"SA","type":"education","lineage":["https://openalex.org/I91450128"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Mohammed Jubur","raw_affiliation_strings":["Department of Computer, Network Engineering, Jazan University, Jazan, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-9398-3875","affiliations":[{"raw_affiliation_string":"Department of Computer, Network Engineering, Jazan University, Jazan, Saudi Arabia","institution_ids":["https://openalex.org/I91450128"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059730489","display_name":"Nitesh Saxena","orcid":"https://orcid.org/0000-0001-6083-104X"},"institutions":[{"id":"https://openalex.org/I91450128","display_name":"Jazan University","ror":"https://ror.org/02bjnq803","country_code":"SA","type":"education","lineage":["https://openalex.org/I91450128"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Nitesh Saxena","raw_affiliation_strings":["Department of Computer, Network Engineering, Jazan University, Jazan, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-6083-104X","affiliations":[{"raw_affiliation_string":"Department of Computer, Network Engineering, Jazan University, Jazan, Saudi Arabia","institution_ids":["https://openalex.org/I91450128"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5115708306","display_name":"Faheem A. Reegu","orcid":null},"institutions":[{"id":"https://openalex.org/I91450128","display_name":"Jazan University","ror":"https://ror.org/02bjnq803","country_code":"SA","type":"education","lineage":["https://openalex.org/I91450128"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Faheem A. Reegu","raw_affiliation_strings":["Department of Computer, Network Engineering, Jazan University, Jazan, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-9167-3061","affiliations":[{"raw_affiliation_string":"Department of Computer, Network Engineering, Jazan University, Jazan, Saudi Arabia","institution_ids":["https://openalex.org/I91450128"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I91450128"],"apc_list":null,"apc_paid":null,"fwci":1.7028,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.88940876,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":98},"biblio":{"volume":"24","issue":"6","first_page":"4623","last_page":"4638"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T13243","display_name":"Innovation in Digital Healthcare Systems","score":0.578000009059906,"subfield":{"id":"https://openalex.org/subfields/3605","display_name":"Health Information Management"},"field":{"id":"https://openalex.org/fields/36","display_name":"Health Professions"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},"topics":[{"id":"https://openalex.org/T13243","display_name":"Innovation in Digital Healthcare Systems","score":0.578000009059906,"subfield":{"id":"https://openalex.org/subfields/3605","display_name":"Health Information Management"},"field":{"id":"https://openalex.org/fields/36","display_name":"Health Professions"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8382166624069214},{"id":"https://openalex.org/keywords/usability","display_name":"Usability","score":0.7377475500106812},{"id":"https://openalex.org/keywords/factor","display_name":"Factor (programming language)","score":0.5180923342704773},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.5148986577987671},{"id":"https://openalex.org/keywords/multi-factor-authentication","display_name":"Multi-factor authentication","score":0.5103382468223572},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.43548157811164856},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.37430500984191895},{"id":"https://openalex.org/keywords/authentication-protocol","display_name":"Authentication protocol","score":0.34516239166259766},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.19018512964248657},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.0654076337814331}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8382166624069214},{"id":"https://openalex.org/C170130773","wikidata":"https://www.wikidata.org/wiki/Q216378","display_name":"Usability","level":2,"score":0.7377475500106812},{"id":"https://openalex.org/C2781039887","wikidata":"https://www.wikidata.org/wiki/Q1391724","display_name":"Factor (programming language)","level":2,"score":0.5180923342704773},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.5148986577987671},{"id":"https://openalex.org/C194699767","wikidata":"https://www.wikidata.org/wiki/Q7878662","display_name":"Multi-factor authentication","level":4,"score":0.5103382468223572},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.43548157811164856},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.37430500984191895},{"id":"https://openalex.org/C21564112","wikidata":"https://www.wikidata.org/wiki/Q4825885","display_name":"Authentication protocol","level":3,"score":0.34516239166259766},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.19018512964248657},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0654076337814331}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tmc.2024.3524093","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tmc.2024.3524093","pdf_url":null,"source":{"id":"https://openalex.org/S69141925","display_name":"IEEE Transactions on Mobile Computing","issn_l":"1536-1233","issn":["1536-1233","1558-0660","2161-9875"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Mobile Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https://openalex.org/W2030112111","https://openalex.org/W2039728845","https://openalex.org/W2099889974","https://openalex.org/W2110495618","https://openalex.org/W2735788045","https://openalex.org/W2795673503","https://openalex.org/W2911547762","https://openalex.org/W2912802756","https://openalex.org/W3015349823","https://openalex.org/W3170696348","https://openalex.org/W6632930104","https://openalex.org/W6767171021","https://openalex.org/W6802249599"],"related_works":["https://openalex.org/W2093798919","https://openalex.org/W3101929529","https://openalex.org/W2907262898","https://openalex.org/W2393298610","https://openalex.org/W2050433615","https://openalex.org/W2034419863","https://openalex.org/W3022695109","https://openalex.org/W2363363251","https://openalex.org/W4309172146","https://openalex.org/W2054202867"],"abstract_inverted_index":{"Push-based":[0],"two-factor":[1],"authentication":[2,101,169,191],"(2FA)":[3],"methods,":[4,272],"such":[5],"as":[6,188,275],"the":[7,48,68,100,104,119,127,146,159,168,180,185,190,194,287],"\u201dJust-Confirm\u201d":[8],"approach,":[9],"are":[10,34,71,108],"popular":[11],"due":[12],"to":[13,19,36,43,58,75,110,121,144,293],"their":[14,28],"user-friendly":[15],"design,":[16],"requiring":[17],"users":[18,59],"simply":[20],"approve":[21],"or":[22],"deny":[23],"a":[24,94,122,137,175,256],"push":[25,53,105],"notification":[26,92,120],"on":[27,98,174,179,286],"mobile":[29,130],"device.":[30,196],"However,":[31],"these":[32,112],"methods":[33],"vulnerable":[35],"\u201dconcurrency":[37],"attacks,\u201d":[38],"where":[39,158,184],"an":[40],"attacker":[41],"attempts":[42],"log":[44],"in":[45,132,173,226,242],"immediately":[46],"after":[47],"legitimate":[49],"user,":[50],"causing":[51],"multiple":[52],"notifications":[54,70],"that":[55,220,263],"may":[56],"lead":[57],"inadvertently":[60],"approving":[61],"fraudulent":[62,252],"access.":[63],"This":[64],"vulnerability":[65,258],"arises":[66],"because":[67],"login":[69,77,91,124,200,253],"not":[72],"uniquely":[73],"bound":[74],"individual":[76],"attempts.":[78],"To":[79],"address":[80],"this":[81],"issue,":[82],"Push-Compare-and-Confirm":[83,222,265],"2FA":[84,271],"method":[85],"enhances":[86,266],"security":[87,149,267],"by":[88],"associating":[89],"each":[90],"with":[93,141,208,229],"unique":[95],"code":[96,210,290],"displayed":[97],"both":[99,189,203],"terminal":[102,170,192],"and":[103,148,177,182,193,205,214,283],"notification.":[106],"Users":[107],"required":[109],"match":[111],"codes":[113],"before":[114],"confirming":[115,178],"access,":[116],"thereby":[117],"binding":[118],"specific":[123],"attempt.":[125],"Recognizing":[126],"ubiquity":[128],"of":[129,150,251,289],"devices":[131],"daily":[133],"life,":[134],"we":[135],"conducted":[136],"comprehensive":[138],"user":[139,284],"study":[140,153],"65":[142],"participants":[143],"evaluate":[145],"usability":[147,225],"Push-Compare-and-Confirm.":[151],"The":[152],"considered":[154],"two":[155],"scenarios:":[156],"one":[157],"user\u2019s":[160],"second-factor":[161,195],"device":[162],"(phone)":[163],"is":[164],"physically":[165],"separate":[166],"from":[167],"(e.g.,":[171],"logging":[172],"PC":[176],"phone),":[181],"another":[183],"phone":[186],"serves":[187],"Participants":[197,245],"completed":[198],"24":[199],"trials,":[201],"including":[202],"benign":[204,227],"attack":[206,243,295],"scenarios,":[207,228],"varying":[209],"lengths":[211],"(four":[212],"characters":[213],"six":[215],"characters).":[216],"Our":[217],"results":[218],"indicate":[219],"while":[221],"maintains":[223],"high":[224],"True":[230],"Positive":[231],"Rates":[232],"(<italic":[233],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[234],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">TPR</i>)":[235],"exceeding":[236],"95%,":[237],"it":[238],"presents":[239],"significant":[240],"challenges":[241],"detection.":[244],"correctly":[246],"identified":[247],"only":[248],"about":[249],"50%":[250],"attempts,":[254],"indicating":[255],"substantial":[257],"remains.":[259],"These":[260],"findings":[261],"suggest":[262],"although":[264],"over":[268],"standard":[269],"push-based":[270],"additional":[273],"measures\u2014such":[274],"more":[276],"intuitive":[277],"interface":[278],"designs,":[279],"clearer":[280],"visual":[281],"cues,":[282],"education":[285],"importance":[288],"verification\u2014are":[291],"necessary":[292],"improve":[294],"detection":[296],"rates":[297],"without":[298],"compromising":[299],"usability.":[300]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":1}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}