Un estudio de usabilidad de la autenticación basada en passkeys

Erick Arnie Zavaleta Galarza; Alexander Josué Venturo Ramos; Cristhian André Jondec Delgado; Alberto Carlos Mendoza de los Santos

doi:10.37431/conectividad.v7i2.429

Authors

Erick Arnie Zavaleta Galarza National University of Trujill https://orcid.org/0009-0002-5880-3626
Alexander Josué Venturo Ramos National University of Trujillo https://orcid.org/0009-0003-4203-134X
Cristhian André Jondec Delgado National University of Trujillo https://orcid.org/0009-0004-9566-9301
Alberto Carlos Mendoza de los Santos National University of Trujillo https://orcid.org/0000-0002-0469-915X

DOI:

https://doi.org/10.37431/conectividad.v7i2.429

Keywords:

Passwordless authentication, Passwords, User experience, Cybersecurity, System usability scale

Abstract

Traditional passwords present critical limitations in usability and security, with reuse rates exceeding 60% and elevated cognitive fatigue among users. Passkeys, implemented under FIDO2/WebAuthn standards, emerge as a passwordless alternative based on public-key cryptography. To comparatively evaluate usability and perceived satisfaction between passkeys and traditional passwords through quantitative evidence in a Latin American university context. Controlled experimental study with between-subjects design (n=30 university participants, mean age=21.4 years) randomly assigned to two groups during a one-week testing period. The System Usability Scale (SUS), demographic questionnaire, and Likert-type satisfaction questions were administered. Analysis included non-parametric tests (Mann-Whitney U) and Spearman correlations. Passkeys obtained a mean SUS score of 83.2 (SD=5.04), significantly higher than traditional passwords (71.8, SD=2.2). Overall satisfaction and ease of use were higher for passkeys (8.53 and 8.86 respectively) versus passwords (7.73 and 7.46). Correlations between satisfaction-SUS (ρ=0.41) and ease-SUS (ρ=0.35) were moderate-weak. Passkeys demonstrate significant advantages in usability and acceptance, constituting a viable alternative to replace passwords in commercial applications, particularly among young populations with moderate technological experience.

References

Abdrabou, Y., Abdelrahman, Y., Khamis, M., & Alt, F. (2021). Think Harder! Investigating the Effect of Password Strength on Cognitive Load during Password Creation. Proceedings of the CHI Conference on Human Factors in Computing Systems. https://doi.org/10.1145/3411763.3451636

Arias Cabarcos, P. & Meyer, P. (2025). ‘The more accounts I use, the less I have to think’: A Longitudinal Study on the Usability of Password Managers for Novice Users. USENIX Proceedings of the Twenty-First Symposium on Usable Privacy and Security. August 11–12, 2025 • Seattle, WA, USA. https://www.usenix.org/conference/soups2025/presentation/cabarcos

Ashish, N., Jeong, J. J., Shah, S. W. A., Nosouhi, M., & Doss, R. (2024). Examining usable security features and user perceptions of Physical Authentication Devices. Comput. Secur., 139(C). https://doi.org/10.1016/j.cose.2023.103664

Brooke, J. (1996). SUS: A “quick and dirty” usability scale. In P. W. Jordan, B. Thomas, B. A. Weerdmeester, & I. L. McClelland (Eds.), Usability Evaluation in Industry (pp. 189–194). London: Taylor & Francis.

Feinberg, S., & Murphy, M. (2000). Applying cognitive load theory to the design of Web-based instruction. IPCC/SIGDOC ’00: Proceedings of IEEE Professional Communication Society International Professional Communication Conference and Proceedings of the 18th Annual ACM International Conference on Computer Documentation: Technology & Teamwork, 353–360. https://doi.org/10.1109/IPCC.2000.887293

FIDO Alliance. (2023). Passkeys: Passwordless Authentication. https://fidoalliance.org/specifications/

Grawemeyer, B., & Johnson, H. (2011). Using and managing multiple passwords: A week to a view. Interacting with Computers, 23(3), 256–267. https://doi.org/10.1016/j.intcom.2011.03.007

Kennesaw State University (2025). An Investigation on Users' In-category Password Reuse Behavior. Coles College of Business Working Paper Series, 5. https://campus.kennesaw.edu/colleges-departments/coles/research/docs/spring-2025/spring-2025-05.pdf

Lyastani, S. G., Schilling, M., Neumayr, M., Backes, M., & Bugiel, S. (2020). Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication. 2020 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 2020, pp. 268-285, doi: 10.1109/SP40000.2020.00047. https://ieeexplore.ieee.org/document/9152694

Mujeye, S. (2016). An Experimental Study on the Role of Password Strength and Cognitive Load on Employee Productivity [Doctoral dissertation, Nova Southeastern University]. https://nsuworks.nova.edu/cgi/viewcontent.cgi?article=1962&context=gscis_etd

Owens, K., Anise, O., Krauss, A., & Ur, B. (2021). User Perceptions of the Usability and Security of Smartphones as FIDO2 Roaming Authenticators. Proceedings of the Seventeenth Symposium on Usable Privacy and Security. August 9–10, 2021, 57–76. https://www.usenix.org/conference/soups2021/presentation/owens

Reese, K., Smith, T., Dutson, J., Armknecht, J., Cameron, J., & Seamons, K. (2019). A Usability Study of Five Two-Factor Authentication Methods. USENIX Symposium on Usable Privacy and Security. Proceedings of the Fifteenth Symposium on Usable Privacy and Security. August 12–13, 2019, Santa Clara, CA, USA. https://www.usenix.org/conference/soups2019/presentation/reese

Ruoti, S., Andersen, J. M., Zappala, D., & Seamons, K. E. (2016). Why Johnny Still, Still Can’t Encrypt: Evaluating the Usability of a Modern PGP Client. USENIX Symposium on Usable Privacy and Security. https://doi.org/10.48550/arXiv.1510.08555

Sauro, J., & Lewis, J. R. (2016). Quantifying the User Experience: Practical Statistics for User Research (2nd ed). Morgan Kaufmann.

Suria, O. (2024). A Statistical Analysis of System Usability Scale (SUS) Evaluations in Online Learning Systems. Journal of Information Systems and Informatics, 6(2), 997–1004. https://doi.org/10.51519/journalisi.v6i2.750