Current mechanisms for authenticating communication between devices that share no prior context are inconvenient for ordinary users, without the assistance of a trusted authority. We present and analyze seeing-is-believing, a system that utilizes 2D barcodes and camera-telephones to implement a visual channel for authentication and demonstrative identification of devices. We apply this visual channel to several problems in computer security, including authenticated key exchange between devices that share no prior context, establishment of a trusted path for configuration of a TCG-compliant computing platform, and secure device configuration in the context of a smart home.

/pdf/seeing-is-believing-using-camera-phones-for-human-verifiable-3mst0x1js1.pdf

Seeing-is-believing: using camera phones for human-verifiable authentication

Keylogging and phishing attacks can extract user identity and sensitive account information for unauthorized access to users' financial accounts. Most existing or proposed solutions are vulnerable to session hijacking attacks. We propose a simple approach to counter these attacks, which cryptographically separates a user's long-term secret input from (typically untrusted) client PCs; a client PC performs most computations but has access only to temporary secrets. The user's long-term secret (typically short and low-entropy) is input through an independent personal trusted device such as a cellphone. The personal device provides a user's long-term secrets to a client PC only after encrypting the secrets using a pre-installed, "correct" public key of a remote service (the intended recipient of the secrets). The proposed protocol (MP-Auth) realizes such an approach, and is intended to safeguard passwords from keyloggers, other malware (including rootkits), phishing attacks and pharming, as well as to provide transaction security to foil session hijacking. We report on a prototype implementation of MP-Auth, and provide a comparison of web authentication techniques that use an additional factor of authentication (e.g. a cellphone, PDA or hardware token).

/pdf/using-a-personal-device-to-strengthen-password-2wyml2tg34.pdf

Using a personal device to strengthen password authentication from an untrusted computer

There has been roughly 15 years of research into approaches for aligning research in Human Computer Interaction with computer Security, more colloquially known as ``usable security.'' Although usability and security were once thought to be inherently antagonistic, today there is wide consensus that systems that are not usable will inevitably suffer security failures when they are deployed into the real world. Only by simultaneously addressing both usability and security concerns will we be able to build systems that are truly secure. This book presents the historical context of the work to date on usable security and privacy, creates a taxonomy for organizing that work, outlines current research objectives, presents lessons learned, and makes suggestions for future research. Table of Contents: Acknowledgments / Figure Credits / Introduction / A Brief History of Usable Privacy and Security Research / Major Themes in UPS Academic Research / Lessons Learned / Research Challenges / Conclusion: The Next Ten Years / Bibliography / Authors' Biographies

Usable Security: History, Themes, and Challenges

/pdf/using-a-personal-device-to-strengthen-password-4b9smsx7lh.pdf

Using a Personal Device to Strengthen Password Authentication from an Untrusted Computer (Revised March 2007)

As computing becomes pervasive, people increasingly rely on public computers to do business over the Internet. But accessing today's web-based services invariably requires typing a username and password to authenticate – a significant vulnerability, since the password can be captured by the public computer and later reused by a hostile party. We introduce a solution to this problem using a mobile phone as a hand-held authentication token and a security proxy which allows the system to be used with unmodified third-party web services. Our goal is to create an authentication system that is both secure and highly usable. Figure 1 illustrates the authentication process. A user who wishes to use an Internet kiosk to access a remote service requiring authentication would instead connect to a trusted security proxy (step 1). The proxy stores the user's passwords and can use them to log in to the remote service. It also stores a mobile phone number for each user, to which a short text message (SMS) is sent to complete the authentication. Once the user responds to this message, the user’s connection from the kiosk is authenticated (step 2). The proxy then operates as a traditional web proxy and mediates all aspects of the user's communication with the remote service, but preventing long-term authenticators (e.g., cookies) from touching the kiosk (step 3).

/pdf/secure-web-authentication-with-mobile-phones-2mtb4vzqts.pdf

Secure Web Authentication with Mobile Phones

The use of computers in public places is increasingly common in everyday life. In using one of these computers, a user is trusting it to correctly carry out her orders. For many transactions, particularly banking operations, blind trust in a public terminal will not satisfy most users. In this paper the aim is therefore to provide the user with authenticated communication between herself and a remote trusted computer, via the untrusted computer.After defining the authentication problem that is to be solved, this paper reduces it to a simpler problem. Solutions to the simpler problem are explored in which the user carries a trusted device with her. Finally, a description is given of two camera-based devices that are being developed.

/pdf/the-untrusted-computer-problem-and-camera-based-1jv1vh24jd.pdf

Thomas Kotwal

Papers

The Untrusted Computer Problem and Camera-Based Authentication