SecurePay: Strengthening Two-Factor Authentication for Arbitrary Transactions

Konoth, Radhesh Krishnan; Fischer, Björn; Fokkink, Wan; Αθανασόπουλος, Ηλίας; Razavi, Kaveh; Bos, Herbert

doi:10.1109/eurosp48549.2020.00043

Cited by 7 publications

(5 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SecurePay:Strengthening Two-Factor Authentication for Arbitrary Transactions [10]. The paper presents a novel approach, SecurePay, aimed at enhancing the security of two-factor authentication (2FA) on mobile phones, acknowledging the vulnerability of existing schemes where compromised phones can undermine the effectiveness of 2FA.…”

Section: Breaking Mobile Notification-based Authentication Withmentioning

confidence: 99%

Two Factor Authentication by Using Decentralized File Storage System

Suresh,

Balachander,

Varman

et al. 2024

Preprint

View full text Add to dashboard Cite

In today's digital age, the apps we use for social and business things are getting more advanced, so we need better ways to check if you are really you. Two-Factor Authentication (2FA) is crucial for making the usual way we confirm identities better, but it does have some challenges. Usual 2FA methods have vulnerabilities such as SIM swapping, denial of service (DoS), and man-in-the-middle (MITM)[1] attacks.These issues continue to exist even when services say they have strong encryption. The central system in 2FA is also problematic because if it's breached, an attacker could impersonate an authorized user or mess up the whole service.To tackle these issues, we are proposing decentralized 2FA methods. This means spreading out the authentication process and using public key encryption. In this system, the user's secret keys are encrypted with their wallet's public key, giving users control over their authentication.Users can generate distinct passwords even without their main device. Therefore, as digital security needs grow, the limitations of traditional 2FA are clear. The solution is to shift to decentralized methods, offering better security and more control for users over how they authenticate.

show abstract

Section: Breaking Mobile Notification-based Authentication Withmentioning

confidence: 99%

Two Factor Authentication by Using Decentralized File Storage System

Suresh,

Balachander,

Varman

et al. 2024

Preprint

View full text Add to dashboard Cite

show abstract

“…Nevertheless, it (a) requires the client to store a sufficiently long secret key (on the mobile phone), (b) requires the laptop/PC that the client uses to be equipped with a camera, and (c) needs the mobile phone to invoke a hash function over a million times that can cause the phone's battery to run out fast. The protocol proposed in [21] mainly relies on a phone's TEE (i.e., ARM TrustZone technology) and messages that the server can directly send to the phone. Later, Imran et al [1] proposes a new protocol that also relies on a phone's TEE, but it improves the protocol presented in [21], in the sense that it is compatible with more android devices and supports biometric authentication too.…”

Section: Variants Of Otp Hardware Tokensmentioning

confidence: 99%

“…The protocol proposed in [21] mainly relies on a phone's TEE (i.e., ARM TrustZone technology) and messages that the server can directly send to the phone. Later, Imran et al [1] proposes a new protocol that also relies on a phone's TEE, but it improves the protocol presented in [21], in the sense that it is compatible with more android devices and supports biometric authentication too.…”

Section: Variants Of Otp Hardware Tokensmentioning

confidence: 99%

A Forward-secure Efficient Two-factor Authentication Protocol

Murdoch¹,

Abadi²

2022

Preprint

View full text Add to dashboard Cite

Two-factor authentication (2FA) schemes that rely on a combination of knowledge factors (e.g., PIN) and device possession have gained popularity. Some of these schemes remain secure even against strong adversaries that (a) observe the traffic between a client and server, and (b) have physical access to the client's device, or its PIN, or breach the server. However, these solutions have several shortcomings; namely, they (i) require a client to remember multiple secret values to prove its identity, (ii) involve several modular exponentiations, and (iii) are in the non-standard random oracle model. In this work, we present a 2FA protocol that resists such a strong adversary while addressing the above shortcomings. Our protocol requires a client to remember only a single secret value/PIN, does not involve any modular exponentiations, and is in a standard model. It is the first one that offers these features without using trusted chipsets. This protocol also imposes up to 40% lower communication overhead than the state-of-the-art solutions do.The adoption of online services, such as online banking and e-commerce, has been swiftly increasing, and so has the effort of adversaries to gain unauthorised access to such services. For clients to prove their identity to a remote service provider, they provide a piece of evidence, called an "authentication factor". Authentication factors can be based on (i) knowledge factors, e.g., PIN or password, (ii) possession factors, e.g., access card or physical hardware token, or (iii) inherent factors, e.g., fingerprint. Knowledge factors are still the most predominant factors used for authentication [6,15]. The knowledge factors themselves are not strong enough to adequately prevent impersonation [29,15]. Multi-factor authentication methods that depend on more than one factor are more difficult to compromise than single-factor methods. Recently (on January 26, 2022), the "Executive Office of the US President" released a memorandum requiring the Federal Government's agencies to meet specific cybersecurity standards, including the use of multi-factor authentication, to reinforce the Government's defences against increasingly sophisticated threat campaigns [23]. Among multi-factor authentication schemes, two-factor authentication (2FA) methods, including those

show abstract

“…There are several forms of biometric geometry, such as facial recognition, digital recognition, voice recognition, signature recognition, and key or screen press patterns. According to Camp (Camp, 2004), the use of biometric technology to identify and digital authentication of individuals involves three distinct phases: Therefore when software has multi-factors it can be assumed that even if an attacker compromises one of the factors, the protection level is higher considering that the attacker will need to compromise the remaining factors (KOSE et al, 2020, Konoth et al, 2020. One of the benefits of adopting MFA is to provide a resilient form of user authentication and it appears to be a very cost-effective mechanism (KOSE et al, 2020).…”

Section: Additional Authentication Factormentioning

confidence: 99%

“…One of the benefits of adopting MFA is to provide a resilient form of user authentication and it appears to be a very cost-effective mechanism (KOSE et al, 2020). In addition to the initial authentication, the second authentication factor is used to protect other sensitive transactions, such as bank transfers (Konoth et al, 2020).…”

Section: Additional Authentication Factormentioning

confidence: 99%

Identification and Applicability of Additional Security Factors on the GOV.BR Digital Identity Platform

Furtado¹,

Correa²

19th CONTECSI International Conference on Information Systems and Technology Management

View full text Add to dashboard Cite

The gov.br Digital Identity (ID) is the Brazilian Federal Government authentication platform used to provide access to different public services, which has several solutions and integrations up than 3,600 public services available to Brazilian citizens, such as digital certificates, banks authentication solutions and data validation in Federal Government databases. Due to its importance and criticality, gov.br ID suffers daily attacks attempts from malicious people who seek to appropriate third-party accounts to request public services of financial nature with the intention of applying blows to the Brazilian Government, harming the citizen who is the real owner and holder of the benefit. Aiming to further improve the security of gov.br ID and access to digital public services, this work carried out a systematic literature review (SLR) to identify additional security factors candidates to be implemented in the current solution.Conducting this SLR we found five additional security factors, namely: RBA, Tripwire, login rituals, OTP, and Bluetooth. From this, an analysis was carried out of each of the factors, in relation to their possibility of implementation in gov.br ID. Finally, the results of this work presents subsidies for maintaining the robustness of gov.br ID ecosystem that supports thousands of daily accesses.

show abstract

SecurePay: Strengthening Two-Factor Authentication for Arbitrary Transactions

Cited by 7 publications

References 41 publications

Two Factor Authentication by Using Decentralized File Storage System

Two Factor Authentication by Using Decentralized File Storage System

A Forward-secure Efficient Two-factor Authentication Protocol

Identification and Applicability of Additional Security Factors on the GOV.BR Digital Identity Platform

Contact Info

Product

Resources

About