The Password You Hope You Never Use: Use Cases for Duress Authentication

While passwords are the most widely used method of authentication, concerns about duress attacks have emerged because attackers are motivated to gain access to our sensitive data. To mitigate this, researchers have proposed duress passwords, allowing users to signal to a system that they are under duress silently. We conduct a survey (𝑁 = 281) to investigate users’ perceptions of potential use cases for duress passwords. Our findings show that users perceive critical societal systems and institutions as use cases due to potentially high consequences of a successful duress attack. Further, they consider personal accounts, such as banking, to benefit from implementing duress passwords. Overall, our findings pave the way for future research aimed at developing solutions effective against duress attacks.