Adaptive authentication: Implementing random canvas fingerprinting as user attributes factor

Daud, Nor Izyani; Haron, Galoh Rashidah; Othman, Siti Suriyati Syd

doi:10.1109/iscaie.2017.8074968

“…RBA models in literature often use user agent strings to identify a browser [24,40,20,46,16]. However, HTML5 canvas and WebGL fingerprints [30,14] are newer approaches considered more difficult to fake. Both approaches received lower RSRs and significantly higher re-authentication counts compared to the user agent string in our data set.…”

Section: Discussionmentioning

confidence: 99%

What’s in Score for Website Users: A Data-Driven Long-Term Study on Risk-Based Authentication Characteristics

Wiefling

¹

,

Dürmuth

²

,

Iacono

³

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Risk-based authentication (RBA) aims to strengthen password-based authentication rather than replacing it. RBA does this by monitoring and recording additional features during the login process. If feature values at login time differ significantly from those observed before, RBA requests an additional proof of identification. Although RBA is recommended in the NIST digital identity guidelines, it has so far been used almost exclusively by major online services. This is partly due to a lack of open knowledge and implementations that would allow any service provider to roll out RBA protection to its users. To close this gap, we provide a first in-depth analysis of RBA characteristics in a practical deployment. We observed N=780 users with 247 unique features on a real-world online service for over 1.8 years. Based on our collected data set, we provide (i) a behavior analysis of two RBA implementations that were apparently used by major online services in the wild, (ii) a benchmark of the features to extract a subset that is most suitable for RBA use, (iii) a new feature that has not been used in RBA before, and (iv) factors which have a significant effect on RBA performance. Our results show that RBA needs to be carefully tailored to each online service, as even small configuration adjustments can greatly impact RBA's security and usability properties. We provide insights on the selection of features, their weightings, and the risk classification in order to benefit from RBA after a minimum number of login attempts.

show abstract

“…RBA models in literature often use user agent strings to identify a browser [25,41,20,47,16]. However, HTML5 canvas and WebGL fingerprints [31,14] are newer approaches considered more difficult to fake. Both approaches received lower RSRs and significantly higher re-authentication counts compared to the user agent string in our data set.…”

Section: Discussionmentioning

confidence: 99%

What's in Score for Website Users: A Data-driven Long-term Study on Risk-based Authentication Characteristics

Wiefling,

Dürmuth,

Iacono

2021

Preprint

View full text Add to dashboard Cite

Risk-based authentication (RBA) aims to strengthen password-based authentication rather than replacing it. RBA does this by monitoring and recording additional features during the login process. If feature values at login time differ significantly from those observed before, RBA requests an additional proof of identification. Although RBA is recommended in the NIST digital identity guidelines, it has so far been used almost exclusively by major online services. This is partly due to a lack of open knowledge and implementations that would allow any service provider to roll out RBA protection to its users. To close this gap, we provide a first in-depth analysis of RBA characteristics in a practical deployment. We observed N=780 users with 247 unique features on a real-world online service for over 1.8 years. Based on our collected data set, we provide (i) a behavior analysis of two RBA implementations that were apparently used by major online services in the wild, (ii) a benchmark of the features to extract a subset that is most suitable for RBA use, (iii) a new feature that has not been used in RBA before, and (iv) factors which have a significant effect on RBA performance. Our results show that RBA needs to be carefully tailored to each online service, as even small configuration adjustments can greatly impact RBA's security and usability properties. We provide insights on the selection of features, their weightings, and the risk classification in order to benefit from RBA after a minimum number of login attempts.

show abstract

“…They rated IP address and geolocation as "high". Daud et al [10] introduced an adaptive authentication method applying HTML5 canvas fingerprinting. The effectiveness of this method is unclear due to the lack of testing with participants.…”

Section: Related Workmentioning

confidence: 99%

“…Canvas fingerprinting and evercookies provide a high level of information [3,10,1]. Canvas fingerprinting can be seen as a more robust and fine-grained version of user agent strings.…”

Section: Inspection Of Rba Featuresmentioning

confidence: 99%

ICT Systems Security and Privacy Protection

2019

IFIP Advances in Information and Communication Technology

2

0

View full text Add to dashboard Cite

Risk-based authentication (RBA) is an adaptive security measure to strengthen password-based authentication. RBA monitors additional implicit features during password entry such as device or geolocation information, and requests additional authentication factors if a certain risk level is detected. RBA is recommended by the NIST digital identity guidelines, is used by several large online services, and offers protection against security risks such as password database leaks, credential stuffing, insecure passwords and large-scale guessing attacks. Despite its relevance, the procedures used by RBA-instrumented online services are currently not disclosed. Consequently, there is little scientific research about RBA, slowing down progress and deeper understanding, making it harder for end users to understand the security provided by the services they use and trust, and hindering the widespread adoption of RBA. In this paper, with a series of studies on eight popular online services, we (i) analyze which features and combinations/classifiers are used and are useful in practical instances, (ii) develop a framework and a methodology to measure RBA in the wild, and (iii) survey and discuss the differences in the user interface for RBA. Following this, our work provides a first deeper understanding of practical RBA deployments and helps fostering further research in this direction.

show abstract

Adaptive authentication: Implementing random canvas fingerprinting as user attributes factor

Cited by 16 publications

References 3 publications

What’s in Score for Website Users: A Data-Driven Long-Term Study on Risk-Based Authentication Characteristics

What’s in Score for Website Users: A Data-Driven Long-Term Study on Risk-Based Authentication Characteristics

What's in Score for Website Users: A Data-driven Long-term Study on Risk-based Authentication Characteristics

ICT Systems Security and Privacy Protection

Contact Info

Product

Resources

About