  Over the past 15 years, researchers have identified an increasing number of
security mechanisms that are so unusable that the intended users either
circumvent them or give up on a service rather than suffer the security. With
hindsight, the reasons can be identified easily enough: either the security
task itself is too cumbersome and/or time-consuming, or it creates high
friction with the users` primary task. The aim of the research presented here
is to equip designers who select and implement security mechanisms with a
method for identifying the ``best fit`` security mechanism at the design stage.
Since many usability problems have been identified with authentication, we
focus on ``best fit`` authentication, and present a framework that allows
security designers not only to model the workload associated with a particular
authentication method, but more importantly to model it in the context of the
user`s primary task. We draw on results from cognitive psychology to create a
method that allows a designer to understand the impact of a particular
authentication method on user productivity and satisfaction. In a validation
study using a physical mockup of an airline check-in kiosk, we demonstrate that
the model can predict user performance and satisfaction. Furthermore, design
experts suggested personalized order recommendations which were similar to our
model`s predictions. Our model is the first that supports identification of a
holistic fit between the task of user authentication and the context in which
it is performed. When applied to new systems, we believe it will help designers
understand the usability impact of their security choices and thus develop
solutions that maximize both.
