Phoolproof Phishing Prevention

Abstract

Phishing, or web spoofing, is a growing problem: the Anti-Phishing Working Group (APWG) received almost 14,000 unique phishing reports in August 2005, a 56% jump over the number of reports in December 2004 [3]. $150,000 [17]. For financial institutions, phishing is a particularly insidious problem, since trust forms the foundation for customer relationships, and phishing attacks undermine confidence in an institution. Phishing attacks succeed by exploiting a user's inability to distinguish legitimate sites from spoofed sites. Prior research focuses on assisting the user in making this distinction, but they require the user to make the right security decision every time. A single mistake results in a total compromise of the user's online account. Unfortunately, humans are ill-suited for performing the security checks necessary for secure authentication. Fundamentally, users should be authenticated using information that they cannot readily reveal to malicious parties. Our system eliminates reliance on perfect user behavior and protects a user's account even in the presence of keyloggers and other forms of spyware. We demonstrate the practicality of our system with a working prototype. Ultimately, placing less reliance on the user during the authentication process will enhance security and eliminate many forms of fraud.

The implementation of two-factor web authentication system based on facial recognition

“…Mobile-assisted authentication schemes [7,22,23,27] have been proposed to protect the user from stealing the password on an insecure computer or from phishing attacks. In these diagrams, it is assumed that mobile devices are reliable and capable of performing certain computer operations such as hashing.…”

“…The password is the actual method for web authentication [1]. However, it cannot provide sufficient protection for password authentication only, because the mechanism is prone to many attacks such as shoulder surfing attack [2], brute force password guessing attack [3][4][5], man in the middle (MITM) attack [6] and phishing attack [7,8].…”

“…At this point, although special hardware-based TFA solutions (e.g., SecurID and smart card) have been introduced long ago, they have not been widely used yet. With the advancement of mobile computing technologies in the past decade, TFA systems supported by many mobile devices have been proposed [7,[21][22][23]; in addition to encryption, reliable mobile device support has become a secondary factor. TFA systems have been developed that are used in SMS-based (e.g., [24,25]) and software-based (e.g., [26]) mobile phones, especially smartphones.…”

On the Theory and Practice of Personal Digital Signatures

“…However, the idea of using a personal (mobile) device to improve security in practice has been studied in several previous papers. In [18], Parno et al use a mobile phone to set up secure SSL/TLS connections and in [15], Mannan and Oorschot use a personal device to improve security of password authentication. Both solutions basically aim to do user authentication with improved security, in particular to protect against key-logging and phising.…”

Countermeasures Against Phishing/Pharming via Portal Site for General Users

“…한편, 피싱/파밍을 방지하기 위한 많은 기술적인 연 구들이 있어 왔다 [3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18] . ② Portal site should provide bank site registration menu on a user account window.…”