Online services request different authentication methods, such as passwords and one-time passwords (OTPs), when you log in to a service. Beyond this, these services also tend to request additional authentication factors, e.g., email verification, when performing certain actions, like changing account settings or requesting account data. Previous research has shown that online services behave very inconsistently regarding what additional authentication factors they request in different scenarios [1]. There is, however, a research gap concerning how specific authentication methods like single sign-on (SSO) or passkeys are affecting the behavior.
This thesis aims to fill this research gap by conducting experiments in which the effect of different authentication configurations is further analyzed to uncover further inconsistencies/patterns on online services. In this regard, it is also possible to look more deeply into other relevant aspects, like security and usability.
References:
[1] "Authentication Inconsistencies Across Online Services: A Multi-Scenario Security Analysis" https://link.springer.com/chapter/10.1007/978-3-032-00639-4_10