Leakage-resilient password entry: Challenges, design, and evaluation

Abstract Password leakage is one of the most serious threats for password-based user authentication. Although this problem has been extensively investigated over the last two decades, there is still no widely adopted solution. In this paper, we attempt to systematically understand the challenges behind this problem and investigate the feasibility of solving it. Since password leakage usually happens when a password is input during authentication, we focus on designing leakage-resilient password entry (LRPE) schemes in this study. We develop a broad set of design criteria and use them to construct a practical LRPE scheme named CoverPad, which not only improves leakage resilience but also retains most usability benefits of legacy passwords. Its practicability is further verified by an extended user study.

[1]  Patrick Olivier,et al.  Multi-touch authentication on tabletops , 2010, CHI.

[2]  Daphna Weinshall,et al.  Cognitive authentication schemes safe against spyware , 2006, 2006 IEEE Symposium on Security and Privacy (S&P'06).

[3]  Manuel Blum,et al.  Secure Human Identification Protocols , 2001, ASIACRYPT.

[4]  R. Aumann.  Subjectivity and Correlation in Randomized Strategies , 1974 .

[5]  Nicolas Christin,et al.  Undercover: authentication usable in front of prying eyes , 2008, CHI.

[6]  Ron Steinfeld,et al.  Does Counting Still Count? Revisiting the Security of Counting based User Authentication Protocols against Statistical Attacks , 2013, NDSS.

[7]  Volker Roth,et al.  A PIN-entry method resilient against shoulder surfing , 2004, CCS '04.

[8]  Frank Stajano,et al.  The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes , 2012, 2012 IEEE Symposium on Security and Privacy.

[9]  Hideki Imai,et al.  Human Identification Through Insecure Channel , 1991, EUROCRYPT.

[10]  Ian Oakley,et al.  The phone lock: audio and haptic shoulder-surfing resistant PIN entry methods for mobile devices , 2011, Tangible and Embedded Interaction.

[11]  David A. Wagner,et al.  Cryptanalysis of a Cognitive Authentication Scheme (Extended Abstract) , 2007, 2007 IEEE Symposium on Security and Privacy (SP '07).

[12]  Yingjiu Li,et al.  On Limitations of Designing Usable Leakage-Resilient Password Systems: Attacks, Principles and Usability , 2012, NDSS 2012.

[13]  Ian Oakley,et al.  Obfuscating authentication through haptics, sound and light , 2011, CHI EA '11.

[14]  Robert H. Deng,et al.  Designing leakage-resilient password entry on touchscreen mobile devices , 2013, ASIA CCS '13.

[15]  Ahmad-Reza Sadeghi,et al.  On the Security of PAS (Predicate-Based Authentication Service) , 2009, 2009 Annual Computer Security Applications Conference.

[16]  Barry Arons,et al.  VoiceNotes: a speech interface for a hand-held voice notetaker , 1993, INTERCHI.

[17]  Heinrich Hußmann,et al.  Vibrapass: secure authentication based on shared lies , 2009, CHI.

[18]  Tsutomu Matsumoto.  Gummy and Conductive Silicone Rubber Fingers , 2002, ASIACRYPT.

[19]  F. Colavita.  Human sensory dominance , 1974 .

[20]  Tal Garfinkel,et al.  Reducing shoulder-surfing by using gaze-based password entry , 2007, SOUPS '07.

[21]  J. Gibson,et al.  Adaptation, after-effect and contrast in the perception of curved lines. , 1933 .

[22]  Heinrich Hußmann,et al.  Towards understanding ATM security: a field study of real world ATM use , 2010, SOUPS.

[23]  Harry Shum,et al.  Secure Human-Computer Identification (Interface) Systems against Peeping Attacks: SecHCI , 2005, IACR Cryptol. ePrint Arch..

[24]  J. Gibson.  Adaptation, after-effect, and contrast in the perception of tilted lines. II. Simultaneous contrast and the areal restriction of the after-effect. , 1937 .

[25]  A. Jensen,et al.  Process differences and individual differences in some cognitive tasks , 1987 .

[26]  Robert Biddle,et al.  Graphical passwords: Learning from the first twelve years , 2012, CSUR.

[27]  Heinrich Hußmann,et al.  Look into my Eyes! Can you guess my Password? , 2009 .

[28]  Patrick Olivier,et al.  Gaze-contingent passwords at the ATM , 2008 .

[29]  Susan Wiedenbeck,et al.  Design and evaluation of a shoulder-surfing resistant graphical password scheme , 2006, AVI '06.

[30]  Cormac Herley,et al.  Can "Something You Know" Be Saved? , 2008, ISC.

[31]  Dawn Xiaodong Song,et al.  Timing Analysis of Keystrokes and Timing Attacks on SSH , 2001, USENIX Security Symposium.

[32]  L. Schenker,et al.  Pushbutton calling with a two-group voice-frequency code , 1960 .

[33]  Shujun Li,et al.  Breaking undercover: exploiting design flaws and nonuniform human behavior , 2011, SOUPS.

[34]  Johnny Long,et al.  No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing , 2008 .