Anchors of Trust: A Usability Study on User Awareness, Consent, and Control in Cross-Device Authentication

Anchors of Trust: A Usability Study on User Awareness, Consent, and Control in Cross-Device Authentication

Speakers: Xin Zhang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=8CEjBkisejg

Overview

Xin Zhang from Fenin University presents a systematic evaluation of cross-device authentication (XDA) across 27 major real-world services, revealing that none adequately protect all three fundamental user rights: the right to know (what device is being authorized), the right to consent (explicit approval), and the right to control (post-authentication session management). The study found that 52% of services provide zero information about the target device during authentication, enabling attacks like QRL jacking where users unknowingly authorize attacker-controlled sessions. Even more concerning, some services bypass user consent entirely after QR code scanning, and 10 services send no notification when a login occurs. A discovered zombie session bug in Zoho allowed real-time chat access to persist even after session revocation. A user study with 100 participants confirmed that 91% prefer knowing target device details, and 98% believe these rights enhance security. The work led to Zoho acknowledging the findings and adding the recommended features to their product roadmap.

Background

▶ Watch: Cross-device authentication: QR codes, push prompts, passkeys (0:30)

The multi-device world has shifted authentication from a single-device process to a cross-device paradigm where users initiate login on a target device but authorize on a trusted device like their smartphone. Three main forms exist: QR code-based login (WhatsApp, TikTok), push-based prompts (Microsoft, Facebook), and passkey/WebAuthn flows (Google). While convenient and moving toward a passwordless future, XDA creates a fundamental contextual gap: the physical separation between devices removes situational cues that help users judge whether a login request is legitimate.

QRL jacking (documented by OWASP) exploits this gap. An attacker displays a malicious QR code on a phishing site. The victim scans it, sees no device or environment information on their phone, thinks "seems good," and approves. The attacker gains full access to the victim's account. This is not a theoretical bug but a systematic design flaw affecting services used by billions.

Key Findings

▶ Watch: Three user rights framework: know, consent, control (4:00)

52% provide zero target device information: More than half of evaluated services show nothing about the device or environment being authorized -- users are essentially blind-approving sessions.

Implicit consent enables QRL jacking: Some services grant access immediately after QR code scanning without any explicit confirmation step, removing the user's last chance to reject a malicious session.

Manipulated consent UI: Four services lacked a deny button entirely. Others used low-contrast colors to nudge users toward approval, constituting dark pattern design in authentication.

Delegated control vulnerability: In WhatsApp, session duration is decided by the target device, not the user's phone. If the target device is compromised, the attacker maintains persistent access without the user seeing an expiration choice.

Post-authentication control gaps: 10 services send no login notification. Facebook buries session review 6 layers deep in settings. Session management interfaces are often difficult to find and use.

Zoho zombie session bug: A critical bug allowed real-time chat access to continue even after the user successfully revoked the session through the normal UI flow, representing a fundamental breakdown of user control.

User validation: 91% of 100 participants prefer knowing target device details, 85% want session management, 98% believe these rights enhance security, and 95% found the enhanced UI usable.

Technical Deep Dive

▶ Watch: Zombie session bug: Zoho chat persists after revocation (8:00)

The evaluation methodology followed a rigorous process: service selection (27 services across 10 categories), systematic workflow documentation through screenshots and notes, grounded theory analysis (open and axial coding to identify patterns), and cross-validation by three independent researchers achieving near-perfect inter-rater agreement.

The framework evaluates 15 metrics across three rights. Right to know: purpose of login, timestamp, device information (type, OS, browser), location, IP address. Right to consent: explicit authorization requirement, duration agreement, deny button presence. Right to control: login notification, session details, revocation capability, notification-to-management linking.

The three proposed recommendations are: Progressive disclosure for awareness (showing key information like location first with adaptive highlighting for anomalies), Active authorization for consent (clear approve/deny buttons, no auto-approval after QR scan), and Instant revocation for control (session revocation that actually works, with notifications linked directly to session management).

Demo / Proof of Concept

▶ Watch: User study: 98% believe enhanced rights improve security (10:00)

The researchers built a fully functional XDA prototype implementing all three rights and evaluated it with 100 Prolific participants in an interactive study. Ten additional participants completed in-depth interactive validation. The prototype demonstrated that adding device information, explicit consent, and session control does not degrade usability (95% found it accessible) while significantly improving security perception (98% agreement).

Defensive Implications

▶ Watch: Design recommendations: progressive disclosure and instant revocation (12:00)

For service providers, the research provides a concrete 15-metric checklist for evaluating and improving cross-device authentication flows. The QRL jacking threat is immediately mitigable by ensuring QR code scanning never auto-grants access and always presents target device information. The zombie session bug in Zoho demonstrates that session revocation must be tested as a security-critical function, not just a UI feature.

For enterprise security teams, the finding that 52% of services provide no target device information means employee training on XDA security must explicitly address the blind approval risk. Organizations should audit which services their employees use for cross-device login and assess the quality of consent and control mechanisms.

Key Takeaways

• None of 27 major services adequately protect all three user rights (know, consent, control) in cross-device authentication
• 52% of services provide zero target device information, enabling blind session approval
• QRL jacking is a systematic design flaw, not a theoretical attack, affecting services used by billions
• A zombie session bug in Zoho allowed continued access after revocation
• 91% of users want target device information and 98% believe enhanced rights improve security without hurting usability
• Zoho has committed to implementing the recommended features on their product roadmap

About the Speaker(s)

Xin Zhang (Shing) is a researcher at Fenin University specializing in usable security, with a focus on cross-device authentication mechanisms and the gap between security design and user understanding. The work represents a systematic evaluation combining security analysis, user study methodology, and concrete design recommendations.