Comparative Analysis of Foundational and New Authentication Methods

Abstract

Information security is built on authentication, and foundational passwords and PINs are no longer sufficient to change cyber threats. The given paper uses the model by Bonneau et al. (that is, The Quest to Replace Passwords) to qualitatively compare the traditional knowledge factors with the newly emerged solutions such as biometrics, behavioral analysis, FIDO2/passkeys, multi-factor schemes, and Zero-Knowledge Proofs according to their security, usability, deployability, and privacy. Our analysis summarizes the strengths, weaknesses and threat models of each of the categories and then summarizes the trade offs in a comparison table. We observe that more modern approaches have a tendency to enhance security at the cost of usually introducing usability, cost, and scalability problems. Behavioral biometrics are vulnerable to privacy and spoofing threats; FIDO2/passkeys are simple to operate but they rely on synchronization infrastructure; and Zero-Knowledge Proofs are secure at the cost of computation. Hybrid and multi-factor designs provide the optimal tradeoff between these factors nowadays, and research in the future should enhance the possibilities of new methods of practical large scale identity systems.