%PDF-1.5 % 4 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 5 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 5 0 obj << /Shading << /Sh << /ShadingType 2 /ColorSpace /DeviceRGB /Domain [0.0 100.00128] /Coords [0.0 0 100.00128 0] /Function << /FunctionType 3 /Domain [0.0 100.00128] /Functions [ << /FunctionType 2 /Domain [0.0 100.00128] /C0 [1 1 1] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [1 1 1] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> ] /Bounds [ 25.00032 75.00096] /Encode [0 1 0 1 0 1] >> /Extend [false false] >> >> /ProcSet [ /PDF ] >> endobj 6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 7 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 7 0 obj << /Shading << /Sh << /ShadingType 2 /ColorSpace /DeviceRGB /Domain [0.0 100.00128] /Coords [0.0 0 100.00128 0] /Function << /FunctionType 3 /Domain [0.0 100.00128] /Functions [ << /FunctionType 2 /Domain [0.0 100.00128] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [0 0 0] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [1 1 1] /C1 [1 1 1] /N 1 >> ] /Bounds [ 25.00032 75.00096] /Encode [0 1 0 1 0 1] >> /Extend [false false] >> >> /ProcSet [ /PDF ] >> endobj 8 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 9 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 9 0 obj << /Shading << /Sh << /ShadingType 2 /ColorSpace /DeviceRGB /Domain [0.0 100.00128] /Coords [0 0.0 0 100.00128] /Function << /FunctionType 3 /Domain [0.0 100.00128] /Functions [ << /FunctionType 2 /Domain [0.0 100.00128] /C0 [1 1 1] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [1 1 1] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> ] /Bounds [ 25.00032 75.00096] /Encode [0 1 0 1 0 1] >> /Extend [false false] >> >> /ProcSet [ /PDF ] >> endobj 10 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 11 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 11 0 obj << /Shading << /Sh << /ShadingType 2 /ColorSpace /DeviceRGB /Domain [0.0 100.00128] /Coords [0 0.0 0 100.00128] /Function << /FunctionType 3 /Domain [0.0 100.00128] /Functions [ << /FunctionType 2 /Domain [0.0 100.00128] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [0 0 0] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 100.00128] /C0 [1 1 1] /C1 [1 1 1] /N 1 >> ] /Bounds [ 25.00032 75.00096] /Encode [0 1 0 1 0 1] >> /Extend [false false] >> >> /ProcSet [ /PDF ] >> endobj 16 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 17 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 17 0 obj << /Shading << /Sh << /ShadingType 3 /ColorSpace /DeviceRGB /Domain [0.0 50.00064] /Coords [50.00064 50.00064 0.0 50.00064 50.00064 50.00064] /Function << /FunctionType 3 /Domain [0.0 50.00064] /Functions [ << /FunctionType 2 /Domain [0.0 50.00064] /C0 [1 1 1] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [1 1 1] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> ] /Bounds [ 22.50027 25.00032] /Encode [0 1 0 1 0 1] >> /Extend [true false] >> >> /ProcSet [ /PDF ] >> endobj 19 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 20 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 20 0 obj << /Shading << /Sh << /ShadingType 3 /ColorSpace /DeviceRGB /Domain [0.0 50.00064] /Coords [50.00064 50.00064 0.0 50.00064 50.00064 50.00064] /Function << /FunctionType 3 /Domain [0.0 50.00064] /Functions [ << /FunctionType 2 /Domain [0.0 50.00064] /C0 [1 1 1] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [1 1 1] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> ] /Bounds [ 21.25026 25.00032] /Encode [0 1 0 1 0 1] >> /Extend [true false] >> >> /ProcSet [ /PDF ] >> endobj 22 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 23 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 23 0 obj << /Shading << /Sh << /ShadingType 3 /ColorSpace /DeviceRGB /Domain [0.0 50.00064] /Coords [50.00064 50.00064 0.0 50.00064 50.00064 50.00064] /Function << /FunctionType 3 /Domain [0.0 50.00064] /Functions [ << /FunctionType 2 /Domain [0.0 50.00064] /C0 [1 1 1] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [1 1 1] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> ] /Bounds [ 20.00024 25.00032] /Encode [0 1 0 1 0 1] >> /Extend [true false] >> >> /ProcSet [ /PDF ] >> endobj 25 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /FormType 1 /Matrix [1 0 0 1 0 0] /Resources 26 0 R /Length 15 /Filter /FlateDecode >> stream xP( endstream endobj 26 0 obj << /Shading << /Sh << /ShadingType 3 /ColorSpace /DeviceRGB /Domain [0.0 50.00064] /Coords [50.00064 50.00064 0.0 50.00064 50.00064 50.00064] /Function << /FunctionType 3 /Domain [0.0 50.00064] /Functions [ << /FunctionType 2 /Domain [0.0 50.00064] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [0 0 0] /C1 [1 1 1] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [1 1 1] /C1 [0 0 0] /N 1 >> << /FunctionType 2 /Domain [0.0 50.00064] /C0 [0 0 0] /C1 [0 0 0] /N 1 >> ] /Bounds [ 21.25026 23.12529 25.00032] /Encode [0 1 0 1 0 1 0 1] >> /Extend [true false] >> >> /ProcSet [ /PDF ] >> endobj 28 0 obj << /S /GoTo /D (section.1) >> endobj 31 0 obj (Introduction) endobj 32 0 obj << /S /GoTo /D (section.2) >> endobj 35 0 obj (Background) endobj 36 0 obj << /S /GoTo /D (section.3) >> endobj 39 0 obj (Requirements and Best Practices) endobj 40 0 obj << /S /GoTo /D (subsection.3.1) >> endobj 43 0 obj (Requirements) endobj 44 0 obj << /S /GoTo /D (subsection.3.2) >> endobj 47 0 obj (Best Practices) endobj 48 0 obj << /S /GoTo /D (section.4) >> endobj 51 0 obj (Methodology) endobj 52 0 obj << /S /GoTo /D (subsection.4.1) >> endobj 55 0 obj (Research Questions) endobj 56 0 obj << /S /GoTo /D (subsection.4.2) >> endobj 59 0 obj (Dataset) endobj 60 0 obj << /S /GoTo /D (subsubsection.4.2.1) >> endobj 63 0 obj (Bank selection) endobj 64 0 obj << /S /GoTo /D (subsubsection.4.2.2) >> endobj 67 0 obj (Selected features) endobj 68 0 obj << /S /GoTo /D (subsection.4.3) >> endobj 71 0 obj (Evaluation criteria) endobj 72 0 obj << /S /GoTo /D (subsubsection.4.3.1) >> endobj 75 0 obj (Requirements and best practices evaluation) endobj 76 0 obj << /S /GoTo /D (subsubsection.4.3.2) >> endobj 79 0 obj (Attacker models and applicability) endobj 80 0 obj << /S /GoTo /D (subsubsection.4.3.3) >> endobj 83 0 obj (Complexity) endobj 84 0 obj << /S /GoTo /D (subsection.4.4) >> endobj 87 0 obj (Correlations between compliance of MFA implementations \(with requirements and best practices\), robustness against security threats and complexity of the MFA protocols adopted by banks) endobj 88 0 obj << /S /GoTo /D (section.5) >> endobj 91 0 obj (Results) endobj 92 0 obj << /S /GoTo /D (subsection.5.1) >> endobj 95 0 obj (Answer to RQ1: Demographics) endobj 96 0 obj << /S /GoTo /D (subsection.5.2) >> endobj 99 0 obj (Answer to RQ2: Compliance with requirements and best practices) endobj 100 0 obj << /S /GoTo /D (subsection.5.3) >> endobj 103 0 obj (Answer to RQ3: Resistance to attacker models) endobj 104 0 obj << /S /GoTo /D (subsection.5.4) >> endobj 107 0 obj (Answer to RQ4: Complexity of MFA Protocols) endobj 108 0 obj << /S /GoTo /D (subsection.5.5) >> endobj 111 0 obj (Answer to RQ5: Correlations between compliance \(with requirements and best practices\), robustness against security threats and complexity of the MFA protocols adopted by banks) endobj 112 0 obj << /S /GoTo /D (section.6) >> endobj 115 0 obj (Threats to Validity and Generality) endobj 116 0 obj << /S /GoTo /D (section.7) >> endobj 119 0 obj (Lessons Learned) endobj 120 0 obj << /S /GoTo /D (section.8) >> endobj 123 0 obj (Conclusion) endobj 124 0 obj << /S /GoTo /D [125 0 R /Fit] >> endobj 128 0 obj << /Length 2199 /Filter /FlateDecode >> stream xڕX[s۸~SP AOLz&t}HX"]^~iIEp9D6w dB8x0JR$+_ë:N=xXƮbh;Ujy?-Ƭ~18X"&V5[[ G$f'%rXYֹdỸu,ˈ܍)MWWj nJHHcai)K,LqEfYD>vI> O۴+>N,rgr{*S{â:J2)|/\i4gQr~frA4%2bA_v" ҈@2S_Xj'ӭxUȈKc{Ӵؓ<3a~Y%2֊%i|WG1UO?n$a7ݭD !fE/r,Jwnp`J E| t폔 us#Oc+?y_Vm[U.3?(~엄T|[~o~dhyG2M[.~G@!=X@<(v%?y<@Hl`|pK[jwզ: Rs=Dfp5I*9ɱ[?t_x7x?鞪AA6}֛zO3UStFdȭ,l]X[ @5Љ)gU(f2ӝ۱s;@6F?SڕZào<4J2N2aHjAh-iLRl#+粋=.v~fi0fa