Exploring Mobile Proxies for Better Password Authentication

Abstract

Abstract. Traditional textual password authentication techniques have numerous well documented security and usability flaws, yet have seen near universal deployment due to their desirable efficiency properties. As a result, many users who may prefer alternative authentication approaches are forced to use passwords or PINs on a daily basis due to a lack of control over third party servers. This work explores the use of a mobile device as a proxy for password management in an attempt to improve remote password authentication without making changes to remote servers. A universal proxy-based authentication framework is presented which allows users to employ a method of their own choice to authenticate locally to their mobile devices (e.g., biometrics or graphical passwords). The framework is also compatible with many communication channels between the mobile proxy and local terminal (e.g., Bluetooth or audio). To demonstrate the practicality of this general framework, a concrete implementation using an "out-of-band" audio channel, called PIN-Audio, is also provided. While existing password management solutions may provide a reasonable level of security for commonplace services, PINAudio is recommended for a user-friendly deployment for security critical applications, such as online banking.

Two-Factor Authentication Resilient to Server Compromise Using Mix-Bandwidth Devices

“…MP-Auth and Phool Proof store hashed password on the servers and thus provide only O(|D|) level of security against offline dictionary attack. PIN-Audio [24] and Tapas [21] use the phone as a mobile password manager that is used to store long and random passwords. These two schemes make the offline dictionary attacks infeasible because passwords are no longer humanmemorable and a dictionary attack is not viable.…”

“…We aim to comply with browser security features and to remain forward-compatible, 2) FBD-WF-WF: The FBD-WF-WF mechanism utilize WiFi as a bidirectional D-C communication medium. While Bluetooth has been explored in user authentication domain in prior work (e.g., [19], [24], [20]), WiFi has received little attention so far. Ad hoc mode WiFi is a common point-to-point infrastructureless wireless channel that can be formed between a device and client terminal equipped with WiFi adaptors.…”