QR-TAN: Secure Mobile Transaction Authentication

Starnberger, Guenther; Froihofer, Lorenz; Goeschka, Karl M.

doi:10.1109/ares.2009.96

Cited by 56 publications

(32 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Starnberger et al [27] describe QR-TAN, a transaction authentication method based on QR codes and a trusted mobile device. In QR-TAN, a shared secret key must be pre-arranged between the mobile device and the server.…”

Section: Sms-basedmentioning

confidence: 99%

“…Mulliner et al [22] have contented that SMS OTP schemes cannot be considered to be secure, as researchers have shown several successful attacks against Global System for Mobile Communications (GSM) and 3G networks [1,12,19]. Furthermore, it has been argued that two, or three, factor authentication does not overcome man-in-the-middle and Trojan attacks [10,26,27]. This paper investigates the challenging problem of user authentication and transaction verification on an untrusted computer or device.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Authentication and Transaction Verification Using QR Codes with a Mobile Device

Chow

Susilo

Yang

et al. 2016

Security, Privacy, and Anonymity in Computation, Communication, and Storage

View full text Add to dashboard Cite

User authentication and the verification of online transactions that are performed on an untrusted computer or device is an important and challenging problem. This paper presents an approach to authentication and transaction verification using a trusted mobile device, equipped with a camera, in conjunction with QR codes. The mobile device does not require an active connection (e.g., Internet or cellular network), as the required information is obtained by the mobile device through its camera, i.e. solely via the visual channel. The proposed approach consists of an initial user authentication phase, which is followed by a transaction verification phase. The transaction verification phase provides a mechanism whereby important transactions have to be verified by both the user and the server. We describe the adversarial model to capture the possible attacks to the system. In addition, this paper analyzes the security of the propose scheme, and discusses the practical issues and mechanisms by which the scheme is able to circumvent a variety of security threats including password stealing, man-in-the-middle and man-in-the-browser attacks. We note that our technique is applicable to many practical applications ranging from standard user authentication implementations to protecting online banking transactions. Abstract. User authentication and the verification of online transactions that are performed on an untrusted computer or device is an important and challenging problem. This paper presents an approach to authentication and transaction verification using a trusted mobile device, equipped with a camera, in conjunction with QR codes. The mobile device does not require an active connection (e.g., Internet or cellular network), as the required information is obtained by the mobile device through its camera, i.e. solely via the visual channel. The proposed approach consists of an initial user authentication phase, which is followed by a transaction verification phase. The transaction verification phase provides a mechanism whereby important transactions have to be verified by both the user and the server. We describe the adversarial model to capture the possible attacks to the system. In addition, this paper analyzes the security of the propose scheme, and discusses the practical issues and mechanisms by which the scheme is able to circumvent a variety of security threats including password stealing, man-in-the-middle and man-in-the-browser attacks. We note that our technique is applicable to many practical applications ranging from standard user authentication implementations to protecting online banking transactions.

show abstract

Section: Sms-basedmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Authentication and Transaction Verification Using QR Codes with a Mobile Device

Chow

Susilo

Yang

et al. 2016

Security, Privacy, and Anonymity in Computation, Communication, and Storage

View full text Add to dashboard Cite

show abstract

“…There were similar solutions [128], but few which combined the benefits of using a mobile phone (instead of a dedicated device) with the simplicity of optical authentication, which allowed for strong challenge-response solutions without the user needing to type information into the phone. Now, it is more common for a user to rely on their smartphone for most of their Web usage, either in the phone browser or in an app.…”

Section: Web Authentication In a Mobile Worldmentioning

confidence: 99%

Web Authentication using Third-Parties in Untrusted Environments

Vapen

2016

Linköping Studies in Science and Technology. Dissertations

View full text Add to dashboard Cite

With the increasing personalization of the Web, many websites allow users to create their own personal accounts. This has resulted in Web users often having many accounts on different websites, to which they need to authenticate in order to gain access. Unfortunately, there are several security problems connected to the use and re-use of passwords, the most prevalent authentication method currently in use, including eavesdropping and replay attacks.Several alternative methods have been proposed to address these shortcomings, including the use of hardware authentication devices. However, these more secure authentication methods are often not adapted for mobile Web users who use different devices in different places and in untrusted environments, such as public Wi-Fi networks, to access their accounts.We have designed a method for comparing, evaluating and designing authentication solutions suitable for mobile users and untrusted environments. Our method leverages the fact that mobile users often bring their own cell phones, and also takes into account different levels of security adapted for different services on the Web.Another important trend in the authentication landscape is that an increasing number of websites use third-party authentication. This is a solution where users have an account on a single system, the identity provider, and this one account can then be used with multiple other websites. In addition to requiring fewer passwords, these services can also in some cases implement authentication with higher security than passwords can provide.How websites select their third-party identity providers has privacy and security implications for end users. To better understand the security and privacy risks with these services, we present a data collection methodology that we have used to identify and capture third-party authentication usage on the Web. We have also characterized the third-party authentication landscape based on our collected data, outlining which types of third-parties are used by which types of sites, and how usage differs across the world. Using a combination of large-scale crawling, longitudinal manual testing, and in-depth login tests, our characterization and analysis has also allowed us to discover interesting structural properties of the landscape, differences in the cross-site relationships, and how the use of third-party authentication is changing over time.Finally, we have also outlined what information is shared between websites in third-party authentication, defined risk classes based on shared data, and profiled privacy leakage risks associated with websites and their identity providers sharing data with each other. Our findings show how websites can strengthen the privacy of their users based on how these websites select and combine their third-parties and the data they allow to be shared. Populärvetenskaplig sammanfattningAllt fler människor tillbringar stora delar av sina liv på Internet för att arbeta, uträtta myndighetsärenden, sköta sin ekonomi och umgås med vänner...

show abstract

“…Function patterns consist of finder, timing and alignment patterns which does not encode any data. The symbol is surrounded on all the four sides by a quiet zone border [7]. A QR Code can be read even if it is tilted or distorted.…”

Section: Literature Surveymentioning

confidence: 99%

Enhancing the Data Capacity of QR Codes by Compressing the Data before Generation

Victor¹

2012

IJCA

View full text Add to dashboard Cite

QR-TAN: Secure Mobile Transaction Authentication

Cited by 56 publications

References 10 publications

Authentication and Transaction Verification Using QR Codes with a Mobile Device

Authentication and Transaction Verification Using QR Codes with a Mobile Device

Web Authentication using Third-Parties in Untrusted Environments

Enhancing the Data Capacity of QR Codes by Compressing the Data before Generation

Contact Info

Product

Resources

About