# Designing the Future of Authentication
source: https://developer.mastercard.com/blog/designing-the-future-of-authentication/index.md

Authors: Students from Carnegie Mellon University. The Masters in Human Computer Interaction (MHCI) at Carnegie Mellon is one of the oldest and most respected programs available in the US for HCI. A big reason why most prospective students apply for the MHCI is for their Capstone Project. The Capstone Project is an intense initiative sponsored by companies like Mastercard who actively champion innovation in technology and user experience (UX). It's a stellar opportunity for MHCI students to apply what they've learned and in turn deliver value to the companies who sponsor them. Our team, comprising of Aroon Mathai, Grace Guo, Nika Zhang, Scott Leinweber, and Zohaib Khan, had the privilege of being sponsored by Mastercard, and were tasked to apply a UX lens to The Future of Authentication in Digital Payments. This post summarizes our journey, touching on our research and design work leading up to our final deliverable: all our insights and findings condensed into a set of guidelines for designing for Continuous Authentication (CA). CA is a way people can be conveniently and securely authenticated in the future. Discovery and Design In January 2018, Mastercard presented our team with our broad challenge: "Design the future of authentication and bridge the gap between payments in physical and digital spaces." To complete the project, we broke it into two phases: Discovery and Design. The Discovery phase was for the team to assess and understand the current payments landscape. Our challenge, while affording us a lot of freedom to think divergently, also meant that we needed to quickly converge that thinking and pick a focus for which to design and build solutions during the Design phase. During Discovery, we carried out extensive primary and secondary research across several different domains. This included blockchain, peer-to-peer payments, wearables and new ways of authentication . We also interviewed many academic and industry experts. More importantly, we recognized the paradox that currently exists between convenience and security. The more secure an authentication experience is (i.e. two-factor authentication), the more friction this creates for the consumer which can impact their decision to complete a transaction. We picked CA as our focus for the Design phase for two reasons: CA's potential to eliminate the above paradox, and provide an experience that is both extremely convenient and secure. Mastercard's 2017 acquisition of a company called NuData Security, which is spearheading CA, made the fit even more relevant Continuous Authentication and its Importance Imagine a world where you can be identified by dozens, or hundreds of different factors that uniquely make up who you are. These can range from the mundane, like your location, or the type of phone you own, to more nuanced, behavioral factors like the way you type or hold your phone. On top of all this, these factors are analyzed in real time, continuously, so that a break in the pattern can immediately be flagged and additional security measures taken. This is Continuous Authentication. It's an evolution of risk-based authentication, and it's on the horizon. Given NuData is already a leader in these technologies, we decided it would be especially valuable to Mastercard if we could design for what the user experience should look like. The UX of Continuous Authentication To structure the Design phase, we first adopted Google Design Sprints but found it a little too rigid for our tastes. They're not meant to be run week after week, consecutively. Since we were sprinting for months (cycles of prototyping and testing), we took the best parts and tailored it to fit our workflow. Over the course of the Design phase, we created 9 different prototypes to test many different research questions, for example: How could CA play a role in social, peer to peer payments? Prototype 2: Avatar Storyboard How do we explain to customers what CA is, and get them to sign up? Prototype 3: Mastercard Instant Onboarding How would CA actually work in a physical store? Prototype 6: Coffee Shop In one of our favorite sprints, we created a proof of concept facial recognition app where multiple people can be identified on the same device, using Tensorflow and Android. In our last and most ambitious sprint of the project, we attempted to find out how people react to using CA over time (Prototype 9: Customer Journey Study ). We ran a large longitudinal study over 8 days with 20 research participants. We created 8 separate websites, with different customer flows, or experiences, within each website. To pull this off, we used a PHP backend and hosted the entire project on Heroku, creating unique user IDs to ensure each of our 20 participants had a personally tailored experience. While this research sprint was a pretty heavy lift, it paid dividends in meaningful user findings. Some of the more interesting and surprising findings were: Extensive education before signing up for CA doesn't necessarily increase comprehension, or feelings of comfort during its use. Friction in the payment process is desirable as it reinforces the feeling of security. The users that were automatically opted in (and given the option to opt out) were the group most comfortable with using CA, and the most positive towards the experience. Our Final Deliverable We've defined Continuous Authentication as a system that can verify who you are, whenever you need it, without you thinking about it. To help make this vision a reality in the near future, our efforts have crystallized into a set of UX guidelines. These guidelines can be accessed here in website form . We also present an overview of how this could all work, as well as a roadmap where we hope these guidelines can be used while introducing Continuous Authentication into existing Mastercard products. Thank You Perhaps our favorite part of the project was when we were invited to New York for an action packed two days at Mastercard's Digital Payments and Labs office. We got feedback on our work from a diverse cross-section of the company, including product, tech and design people. Overall, we're very proud of the work we've done over this project. We're grateful for the opportunity Mastercard has provided us and for their support over the last 7 months. Thank you for the experience.