How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication

Konoth, Radhesh Krishnan; Veen, Victor van der; Bos, Herbert

doi:10.1007/978-3-662-54970-4_24

Cited by 25 publications

(14 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The second and possibly the most popular class of attacks on SMS-based 2FA observed in the wild use malware to steal verification codes and bypass the entire authentication process [16,36]. The first step of this type of attack is to install malware on a user's device, such as a PC or mobile phone.…”

Section: Attacks Against Sms-based 2famentioning

confidence: 99%

Mind your SMSes: Mitigating social engineering in second factor authentication

Siadati

Nguyen

Gupta

et al. 2017

Computers & Security

View full text Add to dashboard Cite

SMS-based second factor authentication is a cornerstone for many service providers, ranging from email service providers and social networks to financial institutions and online marketplaces. Attackers have not been slow to capitalize on the vulnerabilities of this mechanism by using social engineering techniques to coerce users to forward authentication codes. We demonstrate one social engineering attack for which we experimentally obtained a 50% success rate against Google's SMS-based authentication. At the heart of the problem is the messaging associated with the authentication code, and how this must not have been developed with security against social engineering in mind. Pursuing a top-down methodology, we generate alternative messages and experimentally test these against an array of social engineering attempts. Our most robust messaging approach reduces the success of the most effective social engineering attack to 8%, or a sixth of its success against Google's standard second factor verification code messages.

show abstract

Section: Attacks Against Sms-based 2famentioning

confidence: 99%

Mind your SMSes: Mitigating social engineering in second factor authentication

Siadati

Nguyen

Gupta

et al. 2017

Computers & Security

View full text Add to dashboard Cite

show abstract

“…A one-time password or facial recognition system may also serve as a single factor for authentication [7]. SFAs are preferred because of their easy deployment [8,9]. However, passwords that are widely used as single-factor authentication provide what is considered a low level of security.…”

Section: Introductionmentioning

confidence: 99%

P/Key: PUF based second factor authentication

Uysal

Akgün

2023

PLoS ONE

View full text Add to dashboard Cite

One-time password (OTP) mechanisms are widely used to strengthen authentication processes. In time-based one-time password (TOTP) mechanisms, the client and server store common secrets. However, once the server is compromised, the client’s secrets are easy to obtain. To solve this issue, hash-chain-based second-factor authentication protocols have been proposed. However, these protocols suffer from latency in the generation of OTPs on the client side because of the hash-chain traversal. Secondly, they can generate only a limited number of OTPs as it depends on the length of the hash-chain. In this paper, we propose a second-factor authentication protocol that utilizes Physically Unclonable Functions (PUFs) to overcome these problems. In the proposed protocol, PUFs are used to store the secrets of the clients securely on the server. In case of server compromise, the attacker cannot obtain the seeds of clients’ secrets and can not generate valid OTPs to impersonate the clients. In the case of physical attacks, including side-channel attacks on the server side, our protocol has a mechanism that prevents attackers from learning the secrets of a client interacting with the server. Furthermore, our protocol does not incur any client-side delay in OTP generation.

show abstract

“…1 ). Traditional authenticated transactions like applying seals, wax seals are physical security systems ( Konoth, van der Veen & Bos, 2016 ). Sender-based information validation alone cannot provide standard authentication ( Ibrokhimov et al, 2019 ).…”

Section: Introductionmentioning

confidence: 99%

Secure biometric authentication with de-duplication on distributed cloud storage

M¹,

Venkatachalam

Prabu

et al. 2021

PeerJ Computer Science

View full text Add to dashboard Cite

Cloud computing is one of the evolving fields of technology, which allows storage, access of data, programs, and their execution over the internet with offering a variety of information related services. With cloud information services, it is essential for information to be saved securely and to be distributed safely across numerous users. Cloud information storage has suffered from issues related to information integrity, data security, and information access by unauthenticated users. The distribution and storage of data among several users are highly scalable and cost-efficient but results in data redundancy and security issues. In this article, a biometric authentication scheme is proposed for the requested users to give access permission in a cloud-distributed environment and, at the same time, alleviate data redundancy. To achieve this, a cryptographic technique is used by service providers to generate the bio-key for authentication, which will be accessible only to authenticated users. A Gabor filter with distributed security and encryption using XOR operations is used to generate the proposed bio-key (biometric generated key) and avoid data deduplication in the cloud, ensuring avoidance of data redundancy and security. The proposed method is compared with existing algorithms, such as convergent encryption (CE), leakage resilient (LR), randomized convergent encryption (RCE), secure de-duplication scheme (SDS), to evaluate the de-duplication performance. Our comparative analysis shows that our proposed scheme results in smaller computation and communication costs than existing schemes.

show abstract

How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication

Cited by 25 publications

References 11 publications

Mind your SMSes: Mitigating social engineering in second factor authentication

Mind your SMSes: Mitigating social engineering in second factor authentication

P/Key: PUF based second factor authentication

Secure biometric authentication with de-duplication on distributed cloud storage

Contact Info

Product

Resources

About