  Usable and secure authentication on the web and beyond is mission-critical.
While password-based authentication is still widespread, users have trouble
dealing with potentially hundreds of online accounts and their passwords.
Alternatives or extensions such as multi-factor authentication have their own
challenges and find only limited adoption. Finding the right balance between
security and usability is challenging for developers. Previous work found that
developers use online resources to inform security decisions when writing code.
Similar to other areas, lots of authentication advice for developers is
available online, including blog posts, discussions on Stack Overflow, research
papers, or guidelines by institutions like OWASP or NIST.
  We are the first to explore developer advice on authentication that affects
usable security for end-users. Based on a survey with 18 professional web
developers, we obtained 406 documents and qualitatively analyzed 272 contained
pieces of advice in depth. We aim to understand the accessibility and quality
of online advice and provide insights into how online advice might contribute
to (in)secure and (un)usable authentication. We find that advice is scattered
and that finding recommendable, consistent advice is a challenge for
developers, among others. The most common advice is for password-based
authentication, but little for more modern alternatives. Unfortunately, many
pieces of advice are debatable (e.g., complex password policies), outdated
(e.g., enforcing regular password changes), or contradicting and might lead to
unusable or insecure authentication. Based on our findings, we make
recommendations for developers, advice providers, official institutions, and
academia on how to improve online advice for developers.
