Reviewing the Usability of Web Authentication Procedures: Comparing the Current Procedures of 20 Websites

Abstract

A sustainable online environment is essential to protecting businesses from abuse and data breaches. To protect sustainability, websites’ authentication procedures should continuously keep up with new technologies and the ways in which these technologies are used. Thus, a continuous assessment of these authentication procedures is required to ensure their usability. This research aimed to compare the status of the sign-up, sign-in, and password recovery processes on 20 websites. The researcher checked every website in a separate session and used the “think-aloud” technique while recording the screen to ensure accurate data analysis. Specific items were checked during every session to detect the similarities and differences between the tested websites in their authentication processes. The results led to valuable discussions and recommendations for improving authentication procedures. Some of these recommendations include best practices for better design of password rules, determining when two-factor authentication should be compulsory, and understanding how to improve password reset processes and keep accounts secure.

1. Introduction

Cybersecurity issues are central to today’s technology-driven economy. Cyber security has become a key need in providing a sustainable and secure society for internet users in cyberspace. Protecting users includes applying the most effective authentication procedures. Indeed, authentication procedures are continuously changing because of developments in the technology people use. Designers’ understanding of humans and their capabilities has been improving through sciences, such as human–computer interaction. What was the best practice yesterday may be unsuitable today. For instance, 15 years ago, the average user had about 25 accounts that required a password [1]. With the increased usage of the internet, this number has doubled. A recent report showed that, currently, people have an average of 80 accounts requiring passwords [2]. This significant change should lead designers to consider whether a password is still the preferred authentication method because more accounts increase the likelihood of needing to reset passwords. The procedures for resetting passwords differ from one website to another, and the most common procedure is to rely on email or phone numbers. Another method is to use security questions. Users typically select security questions to answer when registering for a new website. One problem with this method is that the answers to these questions may be found on social media [3,4]. Another problem occurs with websites that are not used frequently because it may be hard to remember the answers to the questions after a long period of time. Other procedures include using a user’s registered devices, which are the ones they use regularly and have been saved in the service provider’s systems.

Although security has a human component that must neither be disregarded nor neglected [5], system engineers and designers are rarely taught how to enhance system features while preserving effective decision-making. Security designers must prioritize usability while developing the web authentication process because it only becomes a priority when users complain. Indeed, users disregard or work around ineffective security products [6]. Users tend to only care about security once their accounts are hacked [7].

Most studies focus on alternatives to current security procedures because statistics show evidence of increased data breaches and security hacking. The number of data breaches in the United States has increased by 170% over the past 10 years, from only 662 in 2010 to over 1800 in 2021 [8]. Some studies have focused on one security procedure, such as resetting passwords [9,10,11]. Other studies have focused on only one part of a security procedure, such as password policies [12,13,14,15,16,17] or password meters [18,19,20,21,22]. Some research has focused on specific authentication methods, such as passwords [23,24,25], biometrics [26,27,28,29], or two-factor authentication [30,31,32,33,34,35]. Some have discussed the particular issues of one authentication method, such as the difficulty of remembering many passwords [36,37,38], while others have examined solutions to this issue, such as password managers [39,40,41]. However, many of these studies have focused on usability from the technical side rather than from the human side. To the best of our knowledge, only one series of studies has evaluated various aspects of authentication procedures and discussed their usability and security issues [42,43,44,45]. There are more issues to be tested that require a larger sample. Existing authentication procedures must be studied, beginning with registration procedures, continuing through login procedures, and ending with account recovery procedures.

Some scholars have highlighted the importance of studying the usability of authentication procedures [46,47]. Braz et al. [48] describe the need for usable security principles in the authentication process. This research contributes to the literature by providing some recommendations that help improve the usable security of web authentication methods. To write these recommendations, the current authentication procedures were evaluated and compared with the current state of the sign-up, sign-in, and password reset processes on 20 websites. The researcher checked every website in a separate session and used the “think-aloud” technique while recording the screen to ensure accurate data analysis. During every session, the researcher checked specific items to uncover the similarities and differences between the tested websites in their authentication processes. The anticipated results of the present study could assist designers in developing stronger security procedures that consider human capacities, thereby making procedures easier to utilize and improving the user experience.

The current paper is structured as follows: The first section of this research is divided into a three-part introduction. In the first and second parts, the terms “sustainable security” and “usable security” are defined. Passwords, password policies (rules), and password meters are discussed in the third part because they are essential in website authentication procedures. The present paper’s second section discusses related work, and the third section describes the methodology. The remaining sections are the results, discussion, recommendations, and conclusions.

1.1. Sustainable Security

Sustainability is not limited to environmental issues [49]. In the cyber domain, security entails the prevention of unauthorized access, while sustainability can be defined as maintaining continuous services for users [50]. Some researchers [51] have looked at sustainable security as realigning security objectives to meet users’ needs. A sustainable and secure society for internet users is an essential demand in cyberspace because it maintains the security of data and information. Sustainable cybersecurity must be implemented to safeguard any firm from fraud and data breaches [52]. Sustainable security is influenced by factors such as confidentiality, integrity, availability, and energy consumption [51]. Sustainability factors must be incorporated into security procedures from the very beginning of development [53].

Some researchers have indicated three nodal areas of software sustainability: human, economic, and environmental sustainability [54]. When designing authentication procedures, the human factors must be considered; otherwise, the relationship between users and service providers would be unsustainable. Although the security of the services relies on machines for authentication processes, human intervention can create cyber sustainability problems. For example, there are password regulations that touch practically everyone. A rigid, onerous reset procedure that places too much of a burden on users—whether consumers or employees—quickly costs money and is difficult to maintain. For example, consider a business user who twice tries to log into their account but is unsuccessful; as a result, the system automatically locks the business owner out. The user must then call the help desk and wait for a representative to become available before having the account reset. This is an inefficient and unsustainable process that burns through time, energy, and attention.

1.2. Usable Security

The International Organization for Standardization (ISO) 9241-11 [55] defines usability as “the extent to which a system, product, or service can be used by specified users to achieve specified goals with effectiveness, efficiency, and satisfaction in a specified context of use” ([56] para. 2). The ISO/International Electrotechnical Commission (IEC) 27,000 is an international standard for information security and defines information security as the “preservation of the confidentiality, integrity, and availability of information” (as indicated in [57], p. 5). Merging the concepts of security and usability in information technology means allowing users to complete a task effectively, efficiently, and satisfactorily without any errors that may cause security threats. In the present study, we define usable security procedures as those created to be human capable and that can ensure a high level of protection from cyberattacks. There is always a trade-off between security and usability. The more secure a system is, the less usable it is and vice versa [58]. Usability is a vital part of any system’s development [59].

Human users are the most important part of the security procedures for any software products, systems, or services because they create and use passwords, which are the first line of defense against attacks. Users must meet security rules when creating passwords. However, there is often little concern shown for human factors in the design of security procedures [51], which may lead users to become frustrated with the wasted time and effort in understanding these procedures. In the worst-case scenario, the users may leave the system if they can. To better deal with these issues, experts have attempted to utilize their knowledge of usability and security together. Whitten and Tygar [60] indicate that a security system is usable when its users understand security tasks and how to complete them without errors. The interface should also encourage users to reuse the system [51].

There are different types of methods that apply the principles of usability and security together. One type is inspection methods, which are based on one expert or a group of experts who can evaluate a user interface and critique its compliance with specific guidelines for usability and security [61,62]. This type of method aims to identify security vulnerabilities and usability issues. Another type is the experimental method, which involves participants. Ismailova [63] has tested the usability and security of government websites in the Kyrgyz Republic, finding various errors. Naiakshina et al. [64] experiment with the security of users’ registration on social networking from the developers’ perspective by recruiting student developers.

1.3. Passwords

Passwords are a critical component of any authentication process. Alphanumeric passwords are popular for several reasons, one being that developers can quickly implement them at a low cost on websites, applications, or other software [65]. Another reason for their popularity is their reliability because they are thoughts in users’ minds that are hard to steal. However, there are a number of effective methods for attackers to guess passwords, and they are often hard to memorize [66]. Users must follow best practices to secure their passwords [67]. Although various scholars have predicted that passwords will die, they have continued to be the best available choice for authentication [68]. Indeed, new techniques, such as two-factor authentication, have given passwords more reliability and longevity [69].

1.3.1. Password Policies

Password policies are the requirements or rules shown to users when they are creating their passwords. Services ask users to follow policies to ensure that they create strong passwords [68]. In most cases, users are only able to complete their registration if they meet these requirements. Password policies vary from one service to another. Some standard policies include eight characters that must include at least one uppercase letter, one lowercase letter, and one special character. Other policies may include prohibiting dictionary words or commonly used words such as “admin.” The differences in password policies lead users to face problems with generating and remembering passwords, as indicated in [70]. To overcome these problems, users can apply different strategies. One strategy is to use personal information, such as a birthday or location, as part of the generated password [71]. This strategy leads to passwords that may look complex but can still be guessed [72]. Another strategy is repeating the same password but for different accounts [73]. This may increase the chance of multiple accounts being hacked when a hacker obtains the password file of reused passwords [74]. The problem is that systems cannot detect whether users have reused their passwords, so this behavior continues [68].

1.3.2. Password Meters

Password meters or password checkers help users meet password policies or create strong passwords by giving them real-time feedback about the strength of their newly generated passwords [75]. These meters use different words and colors to describe the level of secure passwords. For instance, some meters use three colors to describe a password’s security level: red for weak, orange for fair, and green for strong. Some meters explain the problems with the newly generated passwords and how to fix them [76]. Other meters show password composition rules in a list, and every time the user meets one of them, the color of the listed rule changes, or the meter shows a green tick mark beside it, which helps users detect the problem. Password meters use heuristics to guide users toward good passwords. Some heuristics predict what users will type [77]. Other heuristics compare a user’s password to other users’ passwords to show how strong the newly generated password is [78,79].

2. Related Work

Bhana and Flowerday [80] encouraged using a particular type of passphrase by finding that user-friendly passphrases are better than traditional passwords for user authentication. Sahin and Li [81] empirically studied the impact of typo-tolerant password authentication using password leak datasets. Jang and Kim [82] tested whether customers’ interactions with an online service could be affected by the culture and usability of the online security service. Kawu et al. [83] studied the relationship between culture and password behavior to determine whether this affects password strength. Rasmussen [84] looked at the usability of roaming software tokens and whether they could replace passwords. Simmons et al. [85] examined the usability of 12 password managers by evaluating specific use cases and design paradigms. Jeong and Jung [86] proposed a password manager that creates a master password that consistently works with other passwords on a user’s devices without storing any passwords. Kariryaa and Schöning [75] presented a new approach to the password meter. When users create a new password, the system looks at their personal information on social media. If their personal information is used in the password, the system suggests that the newly created passwords are weak and can be guessed from public information.

Seitz et al. [13] conducted an online experiment to determine whether users would create stronger passwords when provided with a decoy tool. The decoy tool tests users’ passwords and suggests stronger passwords in a colorful way. The results were mixed, and there were no significant effects of the decoy tool found. Seitz et al. [87] argued for the need for different password policies to avoid password reuse. They indicated that websites should have different password policies to force users to create different passwords for different websites. They presented a new approach that minimizes the number of passwords reused by studying the top 100 websites in Germany, as ranked on Alexa.com. The results showed the possibility of maintaining password strategies that could work for 83 of 100 websites. Seitz [88] believed that password policies should be different for all users. Thus, this study proposes a new approach that provides changeable policies depending on users’ personal information. The author recommends using this approach because passwords tend to survive for a long time. Verkijika [89] evaluated password practices for 37 e-commerce websites in South Africa and reported poor practices for around 92% of the tested websites. Maoneke and Flowerday [15] studied the password policies of the top 30 websites in South Africa in terms of the number of visits. Tsokkis and Stavrou [72] attempted to improve password creation strategies to help users build strong passwords. They proposed a new tool that educates users on how to avoid weak passwords generated by mixing symbols with personal information.

3. Methodology

Inspection methods can help identify the usability issues of such a system and provide helpful recommendations to improve its usability [90]. One of the inspection-based methods, called the “individual expert review”, has been selected to evaluate the usability of web authentication procedures. During the evaluation, the expert discovers usability flaws based on the rules of thumb and his experience [91]. Thus, the evaluator does not have to follow a specific template during the analysis to capture usability flaws and provide some recommendations. This approach has been used in one series of studies [42,43,44,45] that measures the usable security of websites.

In the individual expert review, a single expert looks at specific data about a service while playing the part of a user to identify systemic flaws using a variety of techniques, including an individual walkthrough, a review of the service against specific heuristics, or testing various perspectives of the service. [92] This method has been used by several research papers that have purposes similar to those of the current research [60,93,94]. Some reasons for selecting this method are that no usability labs, participants, or significant expenditures are required [86]. However, the key reason is the ability to test a wide range of websites. For example, only a few websites can be tested with experiments that include participants.

The researcher reviewed and compared the processes of signing up, signing in, and recovering passwords on 20 websites. This sample should be large enough because other studies [42,43,44,45] that have applied the same method for a similar purpose have used fewer websites. Moreover, the present study is more compressive because it compared a variety of items for three different authentication processes. During the sign-up process, the researcher noted information related to the primary key for registration (email or phone number), accepting external accounts, hiding the password while typing, retyping the password, password rules, password meters, robot checks, and verification. During the sign-in process, the reviewer collected information related to the types of sign-in options, such as the “stay signed in” feature, hiding the password while typing, and procedures after login failure, such as robot checks and locking accounts. During the recovery process, the researcher collected information about the type of recovery method used, password rules, whether they were changed, retyping the password, robot checks, and adding an alternative primary key.

To diversify the sample, the researcher reviewed security procedures for 20 websites in five domains (reservation, social media, shopping, entertainment, and tech services). The reason for this diversity is that the responses taken by websites in one domain may not be suitable for other domains. For instance, some social media sites partially freeze accounts when there is suspicious login activity. However, they still allow the user to log in but with limited activities. This practice might not be appropriate for websites in other domains, such as the reservation domain. Thus, besides presenting a comparison with all websites in all domains, the present research explored the opportunity to examine the practices of websites in the same domain. The tested websites were selected based on their popularity according to Statista.com and Similarweb.com. Some websites were skipped because they were the same domain or because they were prohibited in some countries because of their sexual content. The researcher also avoided using more than one website from the same company because the password procedures could be the same. The final selection included Hotels.com, Booking.com, Airbnb, and Marriott Bonvoy for reservation; Facebook, Snapchat, TikTok, and Twitter for social media; Alibaba, Amazon, eBay, and Rakuten for shopping; Dailymotion, IMDb, Netflix, and Spotify for entertainment; and Google, Apple, HUAWEI, and Microsoft for tech services.

The researcher used a new email on Yahoo and a new cell phone number for the purpose of the study. Yahoo was selected because it was not one of the tested websites. QuickTime player was used to record every session. The researcher ensured that the microphone was on for the “think-aloud” technique. This technique requires that “the subject keeps on talking, speaks out loud whatever thoughts come to mind while performing the task at hand” [95]. This technique helped the researcher have a recorded voice for all the usability issues that were captured while examining the website. Thus, this technique allowed for more accurate data analysis. Think-aloud enables evaluators to express their opinions while evaluating a system, which aids in learning more about how the system is used beyond simple behavior tracking. The think-aloud technique is one of the most frequent techniques for evaluating usability [96]. The benefits of using this technique include that evaluators may quickly implement the “think-aloud” method, capture intrinsic cognitive processes that cannot be seen, comprehend the causes of problems with ease, and manage immediate reactions to system operations [97].

The researcher took a screenshot of any new notes, such as the expression used by the website to evaluate the entered password or that guided the user in creating a good password. The experiments were conducted in May 2021. The video for each experiment was watched separately several times, and then, the data were written up as notes in a Word document. After completing this procedure for all websites, the researcher compared the 20 websites to find similarities and differences between their password practices. A table was created to summarize standard information, and additional information was added for explanation and discussion. The videos were watched repeatedly, and the data were written up in the text as notes Figure 1 summarizes the steps involved in the study design.

4. Results

4.1. Sign-Up Process

The results of the sign-up process showed that 11/20 websites allowed users to sign up using their Google, Facebook, or other accounts (See Appendix A 

Table A1. Details of the sign-up process.

Category	Website	Primary Key	Accept Other Accounts	Pass Eye	Pass Rules	Pass Meter	Pass Retype	Robot Check	Verification
Reservation	Hotels	Email	√	×	√	√	×	×	×
	Booking	Email	√	√	√	×	√	×	×
	Airbnb	Email/#	√	√	√	√	×	×	×
	Bonvoy	Email	√	×	√	√	√	×	×
Social Media	Facebook	Email/#	×	×	×	×	×	×	√
	Snapchat	#	×	√	×	√	×	×	√
	TikTok	Email/#	√	√	√	√	×	√	√
	Twitter	Email/#	×	√	√	√	×	×	√
Shopping	Alibaba	Email	×	×	√	√	√	×	√ both
	Amazon	Email	×	×	√	×	√	×	√
	eBay	Email	√	√	√	√	×	×	×
	Rakuten	Email	√	√	√	√	×	√	×
Entertainment	Dailymotion	Email	√	√	√	√	×	√	√
	IMDb	Email	√	×	√	×	√	×	√
	Netflix	Email	√	×	×	√	×	×	×
	Spotify	Email	√	×	×	√	×	√	Retype
Tech. Comp.	Google	New email	×	√	√	×	√	×	N.A.
	Apple	Email	×	×	√	√	√	√	√ both
	HUAWEI	Email/#	×	√	√	×	×	√	Email = √ # = optl
	Microsoft	Email/ New email/#	×	√	×	×	×	√	N.A.

# means cell phone number. √; × means yes or no.

for details). Additionally, 11/20 of websites allowed the viewing of passwords while typing, commonly presented with the word “show” or with an icon that looked like an eye. A total of 15/20 websites asked users to follow specific rules when creating new passwords, as shown in

Table 1. Password rules for each tested website.

Website	Password Rules
Hotels	6–20 characters, with at least one number
Booking	Minimum 10 characters, including uppercase letters, lowercase letters, and numbers
Airbnb	Cannot contain the name or email address of the account holder, requires at least eight characters and a number or symbol
Bonvoy	8–20 characters (lowercase letters, uppercase letters, numbers, or characters)
Facebook	No rule until clicking sign-up button; at least 6 characters (letters + numbers + punctuation marks)
Snapchat	No rule until the user starts typing; at least eight characters; (may use a) mix of uppercase letters, lowercase letters, numbers, and or/symbols
TikTok	8–20 characters (letters, numbers, and special characters)
Twitter	Eight characters or more
Alibaba	6–20 characters—must contain at least two of each (letters, numbers, and symbols)
Amazon	At least six characters
eBay	At least six characters, containing a number or symbols
Rakuten	eight characters or more
Dailymotion	Minimum eight characters (at least one letter, at least one number, and at least one symbol)
IMDb	At least eight characters
Netflix	No rule until clicking “continue”; 4–60 characters
Spotify	Unknown
Google	Eight or more characters with a mix of letters, numbers, and symbols
Apple	Eight or more characters; uppercase and lowercase letters, at least one number
HUAWEI	At least eight characters
Microsoft	No rule until clicking “next”; at least eight characters; at least two each of uppercase letters, lowercase letters, numbers, and symbols

. Some websites had additional rules that remained unknown unless the entered password violated them. For instance, some websites did not accept repeating numbers. The rules of Facebook, Netflix, and Microsoft appeared after clicking the button to sign up or move to the next step, while Snapchat’s rules appeared after the user began typing. The minimum required characters were commonly 6 or 8. However, Booking.com asked for ten, and Netflix asked for a minimum of four characters. Some websites called special characters punctuation marks or symbols, while Bonvoy named them just “characters”.

A total of 15/20 websites provided immediate feedback (meter) for the newly generated password (see

Table 2. Summary of the meter for each tested website.

Website	Immediate Feedback (Meter)
Hotels.com	Worked after moving to the next field (the field turned red when there was a mistake, and a message in red under the field showed the mistake)
Booking.com	Worked after clicking “Create account”; a message in red showed the unsatisfied rules one by one, and the field was in red
Airbnb	Every password rule was on a different line, shown in gray and with an ×; when satisfied, it changed to green and √; password strength was shown (weak = red; good or strong = green)
Bonvoy	Similar to Airbnb, but using red and green
Snapchat	Worked while typing (the word password was in red when moved to its field, and a message in red showed the unsatisfied rule)
TikTok	Worked while typing (every password rule was on a different line and shown in gray color and with an ×; when satisfied, it turned to green)
Twitter	Showed the message “Please enter stronger password” (no specific guidance) in red, and field was in red
Alibaba	Every password rule was on a different line and shown in gray, but with x sign in red; when password rule was satisfied, sign became green √
eBay	A message in gray under the password field; red when the password was simple
Rakuten	Messages “too short”, “weak”, and “very weak” in red, “fair” in orange, and “strong” and “very strong” in blue
Dailymotion	Similar to Alibaba
Netflix	Worked after clicking “continue” for the first time; red for the message and field
Spotify	Worked while typing; showed a vague message (“too short”)
Google	Worked after clicking “next”; both the password field and the message were red
Apple	Similar to TikTok; a line for strength (red, orange = “moderate”, green = “strong”); showed password tips
No meter for Facebook, Amazon, IMDb, HUAWEI, or Microsoft

). Five websites (Facebook, Amazon, IMDb, HUAWEI, and Microsoft) did not provide a meter. On some websites, the meter worked while the user typed. On other websites, the meter worked only after attempting to move to the following field or clicking the button for the next step. Five websites (Airbnb, Bonvoy, TikTok, Alibaba, and Dailymotion) showed every rule in a different line, and their colors changed when they were met. However, Airbnb’s meter generated inaccurate results. Some websites used red when rules were not satisfied, while others used gray. The remaining results of the sign-up process showed that 13/20 websites asked for the password to be retyped, 7/20 websites had robot tests, and 13 verified the primary key/s for the account holder (email and/or phone number).

4.2. Sign-In Process

The results of the sign-in process showed that only 2/20 of websites asked users to retype primary keys (email, phone, username, or ID) after each failed attempt, 13/20 asked users to reenter their password after every failed attempt, 7/20 websites allowed users to view passwords while typing, and 8/20 presented robot tests (See Appendix B 

Table A2. Details of the sign-in process.

Website	Sign-in Options	Email Every Time	Pass Every Time	Pass Eye	Robot Check	Stay Signed In	Account Lock	Comments
Hotels	Email	√	√	×	√	Default = ×	×	Robot after 10 failed attempts
Booking	Email	×	×	√	×	×	√	Locked after 15 fails
Airbnb	Email/#	×	×	√	√	×	×	Robot after five fails (not every time), unless user enters the correct pass
Bonvoy	Email/ Member ID	√	√	×	×	Default = ×	×	N.A.
Facebook	Email/ Member ID	×	√	√	×	×	√	Lock for a few mins after 20 fails + Limit user activities
Snapchat	Email/ Username	×	√	×	×	×	× *	Register using only phone, but sign-in using different options
TikTok	Email/#	×	√	×	√	×	√	Robot after first fail/Shows how many attempts left/Lock for 30 min
Twitter	#/Email/ Username	×	√	×	×	×	×	N.A.
Alibaba	Email/#	×	√	×	×	Default = √	×	A few failed attempts > refresh the page to enter the email again
Amazon	Email/#	×	√	×	×	×	×	After five attempts > takes user to the option of receiving code through email
eBay	Email	×	√	×	√	Default = √	×	Robot after three failed attempts
Rakuten	Email	×	×	×	√	×	×	Robot with every attempt
Dailymotion	Email	×	×	√	×	×	×	N.A.
IMDb	Email	×	√	×	√	Default = √	×	After three fails > robot check every time No lock, but user directed to email code
Netflix	Email	×/√	√	√	×	Default = √	√	Email entered after 20 failed attempts Lock for a few mins
Spotify	Email	×	×	×	×	Default = √	√	Not clear when it is locked
Google	Email	×	√	√	√	×	×	Robot after 30 failed attempts
Apple	Email	×	√	×	×	Default = ×	√	After 10 attempts > locked
HUAWEI	Email/ User ID	×	√	√	√	×	√	Robot after first failed attempt Showed number of remaining attempts after every five fails > lock for 5 min
Microsoft	Email	×	√	×	×	Default = ×	√	After 10 fails > locked

* # means cell phone number. √; × means yes or no.

for details). Some websites showed a robot test only after several failed attempts. A total of 9/20 websites provided the option “stay signed in”. The default value for four websites was “no”, while the rest were “yes”. After failed attempts, 8/20 websites followed the procedure of locking accounts; six websites showed robot tests; two websites asked for a code sent through email; and one website (Facebook) limited the activities of the tested account. Two websites showed the lock time (5 or 30 min), while this remained unknown on other websites.

4.3. Recovery Process

All the tested websites allowed the recovery method to use the registered email or phone number, and some websites provided the opportunity to select an additional recovery method. For example, Google and Apple used registered devices, while Netflix used credit card numbers with first and last names. Bonvoy asked for the member’s ID with first and last names, country name, and the zip code for specific countries. Amazon, eBay, and IMDb offered to call the user as another recovery method.

Table 3. Comments on the recovery process for some websites.

Website	Recovery Process Comments
Booking	The phone number was not used in the recovery process.
Airbnb	The phone number was verified, but it was not used for recovery.
Bonvoy	The phone number was not used for password reset.
Facebook	Users could skip creating a new password.
Amazon	Password rules remained the same, but there were some tips.
eBay	User was not asked to change their password.
Rakuten	Only American phone numbers could be added.
Google	Phone and alternative emails were re-added during registration.
HUAWEI	More password rules were added with a meter.
Microsoft	User had to answer security questions after the code.

shows some comments about specific websites. For example, the Booking, Airbnb, and Bonvoy websites asked users for phone numbers during registration but did not use them as a method for password recovery. Some websites were more flexible with the password created during the sign-up process, since they had fewer password rules, as previously mentioned. However, some of these websites changed their requirements after the first recovery. For example, Amazon provided tips to create stronger passwords, while HUAWEI added more rules and provided a meter.

5. Discussion

The results showed that there are still many differences between websites in terms of security procedures. These differences can confuse users and place large cognitive demands on their memories. Why do websites differ in security procedures? It is still questionable whether the designers of the security procedures follow any usability standards. Although the present research has included leading websites in different domains, the domain itself was not the reason for the differences in security procedures. More investigations are needed to determine the factors behind these differences. The following sections discuss the findings in different sections based on the tested item.

5.1. Using Other Accounts for Sign-Up

This study shows that 11/20 websites offered users the option of signing up using other accounts, such as Google or Facebook. This feature reduces users’ cognitive load by reducing the number of passwords they need to memorize and removing the need to follow new password policies [68,98,99]. However, if the other account has technical issues, the user may not be able to log in to either account. Thus, all users who signed up to Booking.com using their Facebook accounts could not use their accounts on Booking.com when Facebook, WhatsApp, and Instagram were down for around 16 h on Monday, 4 October 2021 [100].

5.2. Masked and Unmasked Passwords

Our results showed that 11/20 websites allowed users to show or hide their passwords while typing. When the password is hidden and formatted in asterisks and the user cannot view it, this is called a masked password. When the user can see a password, it is called an unmasked password [101]. Many usability experts have discussed the harmful effects of masked passwords, such as typing errors and the probability of needing more time to type the password successfully. However, security experts have highlighted the importance of masked passwords in saving users from shoulder surfing. Pidel and Neuhaus [102] conducted an exploratory study to detect the differences between masked and unmasked passwords when using smartphones. They examined specific metrics, such as typing speed, error rate, and the number of backspaces. They found no significant differences between the two cases. This finding supports the need to enhance security more than usability and could answer why nine websites in our sample provided only the option of masked passwords.

5.3. Retyping Passwords

Our results showed that most websites (13/20) asked users to retype their passwords, which means that more time is required for registration. Retyping passwords helps users avoid typing errors and, therefore, minimizes the number of reset times required. However, Bhana and Floweday [80] concluded that the time required for retyping passwords is not worth it. This requirement has positive usability and security effects on retyping passphrases but not passwords. A similar trade-off between security and usability occurs with the “stay signed in” feature. Our results indicate that almost half of the tested websites (9/20) provided this feature. This feature becomes risky when users have opted in and must uncheck the box to opt out. Some users may not notice this while logging in from public devices. Websites face a similar trade-off with the practices used when the user keeps failing to log in. One practice includes asking the user to repeat their username and password after every failed attempt (2/20), repeat only the password (13/20), or adjust the last entered password (5/20). Another practice is having a robot test after every failed attempt or a certain number of failed attempts. TikTok and HUAWEI included a robot test after the first failed attempt; eBay included a robot test after the third attempt; Airbnb included a robot test after the fifth attempt; Hotels.com included a robot test after the tenth attempt; and Google included a robot test after the thirtieth attempt. The other websites had no robot tests at all. Another practice is locking the user’s account or limiting their activities, and our results showed that 8/20 websites locked users’ accounts and 1/20 limited user activities. More than half (11/20) did not use this practice.

5.4. Password Rules

Our study showed that password rules varied from one website to another. This variation makes it difficult for users to remember the passwords they have created. This process becomes even more complicated for websites with additional password rules appearing only after password creation. For example, some websites refused to use the last password or repeated numbers, such as “1122”. Lee et al. [12] conducted an experimental study on 120 of the most popular websites to examine whether they prevented the use of certain passwords. Their sample included websites that prevented passwords that had been leaked in breaches and those that were easy to guess. Their findings showed that 49/120 websites prevented users from using specific passwords. Thus, users had two options: to repeat their passwords in a way that met the rules of most websites or to accept the challenge of remembering many different passwords. Taking the first option (repeating passwords) means that, if there is a breach in one website, the other accounts of the user would be at risk. In other words, users’ bank accounts could be hacked because they used the same passwords for websites or apps with no sensitive data but less security. Stobert and Biddle [103] found that 25/26 of the participants they interviewed reused their passwords. Moreover, Pearman et al. [104] found that 85.07% of passwords created by 154 participants were reused on financial websites, and 95.50% of these passwords were reused on websites in other domains.

Scholars have discussed the abilities of human memory and how difficult it is to remember many passwords [105]. Some experts have indicated that increasing memory load increases the chance of forgetting more items [106]. Remembering many different passwords is incompatible with human capabilities [107]. Thus, some users find a solution to this issue by relying on a password manager (i.e., one password for all). Alkaldi and Renaud [108] indicated that the password manager removes the need to remember password management strategies. However, all passwords become insecure if the password manager’s security is breached [89]. The Saudi government has recognized the issues of passwords and developed a better way to deal with authentication. They have one unified password that can be used for most government services. Recently, they introduced the “NAFATH” app [109], which takes the fingerprints and faceprints of Saudi citizens and residents at the time of first use and saves them for later authentication. When trying to log in to any government services, users must enter their ID without a password. However, users select the correct number that appears to them on the website they are logging into and the app.

5.5. Password Meter

Our study showed that websites used different presentations for meters. Additionally, meters work differently, either post-entry or dynamically, as shown in Table 2. A similar variation in the results was found in another study. Fujita et al. [110] tested 231 websites based on two UX guidelines (friendly timing and friendly explanation). They found that only 35% of the tested websites satisfied these criteria. Moreover, our study found that the Airbnb meter needed to be more accurate. Golla and Dürmuth [111] found no considerable improvement between the accuracy of their tested meters and those available after 2013. They indicated that the accuracy of the actual meters was less than what was proposed in the research. However, the question that should be asked is whether the meter helps users build solid passwords or makes this process complicated or confusing. Several research papers have shown no reliable positive effects on password strength [69]. However, one online study with more than 2000 participants showed that passwords composed with the help of password meters were more secure and harder to guess than those that did not use password meters [112]. Dupuis and Khan [113] proposed a new visualization for meters based on peer feedback. Instead of the traditional progress bar, their meter showed the user how strong their password was by comparing it to other users’ passwords. They indicated that this would help users generate stronger passwords than the traditional meter. Zimmermann et al. [19] noted that findings related to the effectiveness of password meters differed from one study to another. Thus, they introduced a hybrid nudge that contained a combination of password feedback, feedback nudges, and additional guidance. This study showed promising results for password strength. Hartwig and Reuter [114] designed nudging that guides users toward better security decisions in password creation, using white-box-based multidimensional visualizations. This design was based on a changeable radar chart. Their findings presented a somewhat effective nudge for short-term efficacy.

5.6. Recovery Process

Regarding the recovery process, it is surprising that the current study showed that only one website relied on security questions (Microsoft). The question here is whether security questions have become ineffective or whether other methods, such as a one-time password (OTP) via text messages or roaming software tokens, are more effective and secure. Bonneau et al. [115] found that users needed help to recall the answers to their selected questions because they had answered them untruthfully. Albesher and Alhussain [3] found that some answers could be found easily on social media. Doerfler et al. [116] compared the usability of different recovery methods, such as knowledge-based and device-based methods. The knowledge-based category tested users’ ability to recall pre-registered email, pre-registered phone, last login location, and security questions. They found that security questions were the most challenging method for users, since they skipped them three times more than the other knowledge-based challenges. Moreover, the success rate of security questions was much lower (78%) than that of OTP via text messages (98%).

There are different cases in which the user can only receive an OTP via text messages, such as when traveling, by activating their international messages. Other cases when the OTP cannot be received either by text messages or roaming software tokens can occur if there is no network coverage, the phone is stolen or damaged, or it has no battery [26]. Thus, providing users with more than one option for recovery is highly recommended. Google provides users with various methods, such as verifying through registered devices, OTP through alternative email, or OTP via text messages. This increases usability and gives users more flexibility, which facilitates the recovery process. However, it is important to check with users often whether they still have these methods or need to update them. The previously discussed cases for OTP become more annoying for users when OTP is used along with the password for sign-in.

6. Recommendations

There is always a trade-off between security and usability in authentication practices. Specifically, websites that have users’ sensitive information always prioritize security over usability. E-commerce or social media websites concerned with engaging more users tend to consider usability more than security. The answers to which best practices should be applied are specific to each individual case.

• Forcing users to abide by specific password rules may help attackers guess a password. Thus, the researcher observed that large companies, such as Google, do not ask users to satisfy specific requirements for newly generated passwords. The researcher believes that this could make the task of guessing more complicated.
• When developers insist on enforcing many password rules, they should all be explicitly shown to users. Developers should not have implicit rules that are discovered only when users break them. This practice wastes users’ time. Implicit rules, such as prohibiting the repetition of the same number, should be shown as tips or “other rules”.
• Two-factor or multi-factor authentication should be mandatory for websites that have sensitive user information, such as those of banks or hospitals. This two-factor or multi-factor authentication should be optional for other websites to enhance usability.
• Regarding two-factor authentication, users should be granted an alternative option for login when the second factor is unavailable.
• Users should be aware of any login from unrecognized (not registered devices) via email, containing information about the login, such as the type of the device, the location of the login, and the I.P.
• Developers should be required to grant more than one method for password recovery.
• Developers should ask users to perform a security checkup periodically. This checkup should include removing outdated devices, checking recent security events, and updating recovery methods if needed.
• Developers should harness the power of mobile devices that can use the features of biometrics as a method of authentication.
• When using the “stay signed in” feature, developers should treat this feature as opted out, unless the user opts in this feature.

7. Limitations and Future Work

This research was designed to compare the security procedures of 20 websites and discuss their usability based on prior knowledge and experiments. However, empirical research that includes participants is highly necessary. Thus, our future research will evaluate and compare the usability of specific security procedures for different websites in one domain, based on participants’ performance and perceptions. Selecting only one domain should provide a fairer and more reasonable comparison. Furthermore, the security procedures of not only websites but also apps need to be evaluated for two reasons. The first is that they have become more useful for completing various tasks in our daily lives. The second is that their security procedures could be different from websites, since mobile devices allow security designers to rely on biometrics for the authentication process.

8. Conclusions

This study evaluated and discussed different procedures for signing up, signing in, and recovering passwords. There is always a trade-off between security and usability for all the procedures discussed. However, procedures should prioritize security and usability based on the sensitivity of the website’s information. There are some noteworthy findings in this research. One is that security questions are no longer the preferred method of password recovery. With the increase in the diversity and availability of tablets and smartphones which offer validation through biometrics, alternative methods could replace passwords in the future. Another noteworthy finding is that some websites have password rules that need to be explicitly described and that are only discovered when users break them. Ultimately, developers should provide more than one option for login and password recovery to give users more flexibility, especially when there are potential obstacles to using the only option provided. Another remarkable finding is that the programming of password meters is complicated and its results may not be accurate which may confuse users. It is better to have no password meters rather than to have a meter with low accuracy.

This study contributes to the knowledge of usable security. It helps the designers of the security procedures to apply the most usable practices by viewing the results of comparing the practices of 20 leading websites and discussing their usability. This study is unique, since it is comprehensive in terms of covering all the web authentication procedures in all three processes: signing up, signing in, and password resetting. It compared the authentication procedures for websites from the same domain and from other domains, since some practices could be suitable only for websites from the same domain but not appropriate for other domains.