Moving Beyond Passwords: Investigating the Effect of Digital Nudges on Passkey Adoption

Paper Title

Moving Beyond Passwords: Investigating the Effect of Digital Nudges on Passkey Adoption

Publication Info

• Topic area: Digital nudges for improving authentication security and usability.
• Keywords: Passkeys, digital nudges, authentication, FIDO2, usability, security, user behavior, adoption, randomized controlled trial, user experience.

Background and Problem

• Problem / challenge: Passwords pose usability and security challenges, fostering insecure practices. Passkeys offer a secure alternative but face low adoption rates. There is limited empirical research on effective nudging strategies for passkey adoption.
• Significance: Increasing passkey adoption can reduce phishing risks, eliminate password memorization, and improve overall cybersecurity.
• Motivation and related work: Prior studies show passkeys are more secure and usable than passwords but highlight barriers such as misconceptions, entrenched habits, and usability concerns. Research on digital nudges in cybersecurity suggests tailored interventions can shift behavior, but their application to passkey adoption remains underexplored.

Solution

• Proposed approach: Mixed-methods study combining expert interviews and a randomized controlled trial (RCT) to evaluate digital nudges across five user journey touchpoints.
• Novelty:
  1. Identification and design of digital nudges tailored to passkey adoption at five touchpoints.
  2. Large-scale RCT with 3,680 participants to empirically evaluate nudge effectiveness.
  3. Insights into touchpoint-specific receptivity and interaction effects between nudges and stages of the user journey.
  4. Recommendations for ethical and effective nudge deployment in authentication contexts.
• Procedure and key techniques:
  • Conducted 15 expert interviews to identify promising nudges and refine designs.
  • Evaluated nudges at five touchpoints: registration, login, recovery, settings, and activity.
  • Tested three nudges per touchpoint (e.g., salience, visibility, choice default) against a control group.
  • Measured interaction rate, adoption rate, and success rate using click logs and passkey setup callbacks.

Results

• Concrete findings:
  • Nudges significantly increased interaction and adoption rates compared to control conditions.
  • Choice default yielded the highest adoption rates, followed by salience and visibility nudges.
  • Recovery and registration touchpoints were the most effective for engagement, with interaction rates 3–4 times higher than activity.
  • Success rates (adoption among those who interacted) were stable across nudges and touchpoints.
• Advantage over baselines:
  • Nudges outperformed control conditions in stimulating initial engagement and adoption.
  • Salience and visibility nudges preserved user autonomy while achieving comparable adoption rates to choice default.
• Experiments / evaluation:
  • Conducted five RCTs across touchpoints with 3,680 participants.
  • Controlled for demographic differences; no significant confounds observed.
  • Statistical analyses included logistic regression and pairwise proportion tests with Bonferroni correction.
• Limitations and future work:
  • Expert interviews were limited to 15 participants; findings may not generalize across industries.
  • Study was conducted on a European healthcare platform, which may heighten security salience compared to other contexts.
  • Future work should explore nudge combinations, address usability barriers, and replicate findings in diverse sectors and regions.

Summary

This study demonstrates that digital nudges can significantly increase passkey adoption when applied at appropriate touchpoints in the user journey. Nudges like salience, visibility, and choice default were particularly effective, with recovery and registration identified as high-leverage stages for engagement. While nudges primarily influenced initial interaction, success rates were consistent across conditions, suggesting other factors like usability play a role in final adoption. The findings offer actionable recommendations for designing ethical and effective nudges to promote secure authentication practices.