No passwords needed: the iterative design of a parent-child authentication mechanism

Abstract

Even though the vast majority of children are online, our exploration of the user authentication literature and available tools revealed few alternatives specifically for authenticating children. We create an authentication mechanism that reduces the password burden for children and adds customizable parental oversight to increase security. With Bluink, our industry partner, we iteratively designed and user tested three parent-child prototypes, with each iteration addressing issues raised in the previous iteration. Our final design is a parent-child authentication mechanism based on OpenID and FIDO U2F which allows children to log in to websites without requiring a password and enables parents using their mobile device to remotely determine whether a login request should be granted.