This dissertation deals with the field of usable security, particularly in the contexts of online authentication and verifiable voting systems. The ever-expanding role of online accounts in our lives, from social networks to banking or online voting, has led to some initially counterproductive solutions. As recent research has shown, the problem is not just technical but has a very real psychosocial component. Password-based authentication, the subject of most of this thesis, is intrinsically linked to the unconscious mechanisms people use when interacting with security systems. Everyday, users face trade-offs between protecting their security and spending valuable mental resources, with a choice made harder by conflicting recommendations, a lack of standards, and the ad-hoc constraints still frequently encountered. Moreover, as recent results from usable security are often ignored, the problem might stem from a fundamental disconnect between the users, the developers and the researchers. We try to address those problems with solutions that are not only simplified for the user’s sake but also for the developer’s. To this end, we use tools from cryptography and psychology, and report on seven usability experiments.
The first part of the contributions uses a service provider’s point of view, with two tools to improve the end-user’s experience without requiring their cooperation. We start by analysing how easily codes of different structures can be transcribed, with a proposal that reduces error rates while increasing speed. We then look at how servers can accept typos in passwords without changing the general hashing protocol, and how this could improve security.
The second part focuses on end-users, starting by a proposed mental password manager that only depends on remembering only a single passphrase and PIN, with guarantees on the mutual security of generated passwords if some get stolen. We also provide a better way to create such passphrases. As mental computing models are central to expanding this field, we finish by empirically showing why the main model used today is not adapted to the purpose.
In the third part, we focus on voting protocols, and investigate why changing the ones used in practice is an uphill battle. We try to answer a demand for simple paper-based systems by providing low-tech versions of the first paper-based verifiable voting scheme. To conclude, we propose a set of low-tech primitives combined in a protocol that allows usable verifiable voting with no electronic means in small elections.
Defended at Université Sorbonne Paris Cité on June 21st, 2019, before the following jury (final report):
Directors: Nicolas Schabanel and Ted Selker;
Reviewers: Michelle Mazurek (report), David Naccache (report), Peter Y. A. Ryan (report);
Examiners: Adrian Kosowski and Marine Minier (president of the jury). The thesis won the PSL award for best thesis at the science-humanities interface. Here is a video of the short presentation.