ev eval aluat ation of of ri risk base based re re au
play

Ev Eval aluat ation of of Ri Risk-base based Re Re-Au - PowerPoint PPT Presentation

Dec 11, 2023 •538 likes •923 views

Ev Eval aluat ation of of Ri Risk-base based Re Re-Au Authenticat ation Me Meth thods Stephan Wiefling* # , Tanvi Patil + , Markus Drmuth # , Luigi Lo Iacono* H-BRS University of Applied Sciences (*) Ruhr University Bochum ( # ) UNC

  1. Ev Eval aluat ation of of Ri Risk-base based Re Re-Au Authenticat ation Me Meth thods Stephan Wiefling* # , Tanvi Patil + , Markus Dürmuth # , Luigi Lo Iacono* H-BRS University of Applied Sciences (*) Ruhr University Bochum ( # ) UNC Charlotte ( + ) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 1

  2. Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 2

  3. Akamai: Credential Stuffing: Attacks and Economies. In: [state of the internet] Mo Moti tivati tion l Weaknesses in password-based authentication increase l Large-scale password database leaks l Credential Stuffing l Intelligent password guessing* l Phishing / security, vol. 5 (2019) *D. Wang et al.: Targeted online password guessing: An underestimated threat. In CCS ’16. ACM (2016) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 3

  4. Mo Moti tivati tion l 2F 2FA is unpopular l <10% <10% of all Google accounts used ed 2F 2FA in January 2018* 2018* à Us Usin ing Ris Risk-ba based Authentication to to incre reas ase ac account securi rity ty wi with mini nimal impact on on us user int nteraction on *Milka, G.: Anatomy of Account Takeover. In: Enigma 2018. USENIX (Jan 2018) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 4

  5. IP address User agent ... Username Password Risk estimation Risk: Low Medium High Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 5

  6. IP: H-BRS, DE Chrome Windows 10 ... Username Password Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 6

  7. IP: H-BRS, DE Chrome Windows 10 „Same device as ... always“ Username Password Risk estimation Low risk Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 7

  8. IP: Ma Marib ibor, SI Chrome An Android 8. 8.1 ... Username Password Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 8

  9. IP: Ma Marib ibor, SI Chrome „There‘s Android 8. An 8.1 something ... different here“ Username Password Additional Risk estimation Authentication Medium risk Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 9

  10. IP: Ma Marib ibor, SI Chrome „There‘s Android 8. An 8.1 something ... different here“ Username Password Additional Risk estimation Authentication Medium risk Proof for additional authentication Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 10

  11. Ri Risk-base based Au Authenticat ation l Recommended by NIST digital identity guidelines [1] l Used by large online services [2] l More usable than comparable 2FA methods [3] [1] Grassi et al.: Digital identity guidelines. Tech. Rep. NIST SP 800-63b (2017) [2] Wiefling et al.: Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild. In: IFIP SEC ‘19. Springer (2019) [3] Wiefling et al.: More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication. In: ACSAC ’20. ACM (2020) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 11

  12. Servic Se ice Requested authentic Re icatio ion factors Cu Current practice* § Verificat Ve ation code ( em email *, text message) Ama Amazon § Fa Faceb ebook ook Approve login on another computer § l Email verification Identify photos of friends § Asking friends for help § Ve Verificat ation code (text message) l Six digit code § Verificat Ve ation code ( em email )* GO GOG. G.com l Major impact on time exposure and § Enter the city you usually sign in from Go Google usability § Ve Verificat ation code ( em email , text message, app, phone call) l But not studied so far! § Press confirmation button on second device § Ve Verificat ation code ( em email )* Linke Li kedIn *Wiefling et al.: Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild. In: IFIP SEC ‘19. Springer (2019) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 12

  13. Over Overvi view ew l Study l Results l Conclusion Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 13

  14. Overvi Over view ew l Stu Study l Results l Conclusion Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 14

  15. Study Proced St edure l 1. 1. Re Regis istra tratio tion l 2. Login l 3. Exit survey Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 15

  16. St Study Proced edure l 1. Registration l 2. 2. Login in l Re-Authentication requested l Method differed in each condition l 3. Exit survey Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 16

  17. Meth Me thod 1: Sta tate te of th the Art Art (i (in use) l Code-based method l Code in email body Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 17

  18. Meth Me thod 2: Subject ct Line (n (new) w) l Code-based method l Code in email body an and subject ct line Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 18

  19. Meth Me thod 3: Link (n (new) w) l Link-based method l Verification link in email body Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 19

  20. Me Meth thod 3: Link (n (new) w) l Extra confirmation when confirmation device is different* *Based on Google‘s Android device confirmation dialog Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 20

  21. Me Meth thod 3: Link (n (new) w) l Amazon deployed method one year after our study Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 21

  22. Ti Timings: Mea easurem emen ent Enter code Identity confirmation Open Link Confirm Device appears Retrieve Code/Link Re-Authentication Challenge Completion Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 22

  23. Ti Timings: Mea easurem emen ent Enter code Identity confirmation Open Link Confirm Device appears Retrieve Code/Link Re Re-Au Authentication Ch Challenge ge Co Compl pletion Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 23

  24. Study Proced St edure l 1. Registration l 2. Login l 3. 3. Exit it surv rvey Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 24

  25. Over Overvi view ew l Study l Re Results lts l Conclusion Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 25

  26. Res Results: Dem emographics l Recruited via MTurk N=592 Participated n=499 Completed Passed tests à Taken for results n=451 Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 26

  27. Res Results: Dem emographics (n=451) 451) l Associate degree or Gender higher (63%) 0% 20% 40% 60% 80% 100% l No computer science Female Male Non-Binary background (74%) Age 0% 20% 40% 60% 80% 100% 18-24 25-34 45-54 55-64 65-74 Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 27

  28. Res Results: Ti Timings l Challenge completion time: l Median: 6 seconds l No significant differences between devices l Re-Authentication time: l Median: 34 seconds Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 28

  29. Res Results: Challen enge Complet etion Ti Time l Faster in two cases (each p<0.01) l Code-based: Desktop PC for login + authentication l Link-based: Desktop PC for login, mobile device for authentication Desktop/Desktop Desktop/Mobile Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 29

  30. Results: Re Res Re-Au Authenticat ation Time l Faster with code in subject line and body l Desktop PC for login + authentication (p=0.02) Desktop/Desktop Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 30

  31. Res Results: Feel Feelings l Question in exit survey* *Question similar to Golla et al. (CCS ‘18) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 31

  32. Res Results: Feel Feelings l Similar number of mentions in all conditions l With three exceptions Link-based Code in body + subject line State of the art (Code in body) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 32

  33. Results: Feel Res Feelings l Link-based method made users significantly more anxious than code-based methods p=0.02 Link-based State of the art (Code in body) Stephan Wiefling, Tanvi Patil, Markus Dürmuth, Luigi Lo Iacono Maribor, Slovenia | IFIP SEC 2020 33

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Ar Are e you u ev eval aluat uating ng what wh at you u thi hink nk you u ar are?

Ar Are e you u ev eval aluat uating ng what wh at you u thi hink nk you u ar are?

Ar Are e you u ev eval aluat uating ng what wh at you u thi hink nk you u ar are? e? Why focus on evaluation? Overview of Integrated Course Design L. Dee Fink, 2003 Situational Factors Program Mapping Vocational Outcomes

216 views • 21 slides
3D 3D Pos ose e Estimat ation on and and Mod odel el Ret Retriev eval al in n the he

3D 3D Pos ose e Estimat ation on and and Mod odel el Ret Retriev eval al in n the he

3D 3D Pos ose e Estimat ation on and and Mod odel el Ret Retriev eval al in n the he Wild Vincent Lepetit ENPC ParisTech &amp; TU Graz H-O3 O3D : Ha Hand+ d+Obj Object Dataset Da 3D pos 3D ose, e, 3D 3D mod odel el retri

639 views • 28 slides
The BeSt Eval at the 2016 NIST TAC KBP Overview BeSt Eval Task

The BeSt Eval at the 2016 NIST TAC KBP Overview BeSt Eval Task

The BeSt Eval at the 2016 NIST TAC KBP Overview BeSt Eval Task The Role of ERE Annotation Data Basic Annotation Differences in Belief vs. Sentiment

639 views • 21 slides
61A Lecture 27 Announcements Interpreting Scheme The Structure of an Interpreter 4 The

61A Lecture 27 Announcements Interpreting Scheme The Structure of an Interpreter 4 The

61A Lecture 27 Announcements Interpreting Scheme The Structure of an Interpreter 4 The Structure of an Interpreter Eval Apply 4 The Structure of an Interpreter Eval Base cases: Apply 4 The Structure of an Interpreter Eval Base cases:

1.09k views • 93 slides
Risk-Based Coding and Reimbursement What is Risk-Based Coding? Risk-Based Coding Overview A

Risk-Based Coding and Reimbursement What is Risk-Based Coding? Risk-Based Coding Overview A

Risk-Based Coding and Reimbursement What is Risk-Based Coding? Risk-Based Coding Overview A diagnosis coding methodology utilized in risk adjustment models to adjust cost for all patients within a health plan or group Risk

385 views • 23 slides
Model-based ased Ve Veri rific icatio ation, Optim imiz ization ation, Sy Synthesi hesis

Model-based ased Ve Veri rific icatio ation, Optim imiz ization ation, Sy Synthesi hesis

Model-based ased Ve Veri rific icatio ation, Optim imiz ization ation, Sy Synthesi hesis s and Perform ormanc ance e Evalu luation tion of Real-Time ime Sy Systems tems Al Alexandr xandre e Dav avid d Ki Kim m G. .

1.01k views • 49 slides
By Millike n De ve lopme nt Cor por ation SI T E MAP WE ST VANCOUVE R Ne e d fo r

By Millike n De ve lopme nt Cor por ation SI T E MAP WE ST VANCOUVE R Ne e d fo r

By Millike n De ve lopme nt Cor por ation SI T E MAP WE ST VANCOUVE R Ne e d fo r Assiste d L iving a nd Me mo ry Ca re in We st Va nc o uve r Conc lusion Base d o ur re se arc h and analysis, we c o nc lude that the Altus

413 views • 20 slides
Field-Based Risk Reduction Presented to AOC Garden State Chapter Dr. Richard H. Wittstruck

Field-Based Risk Reduction Presented to AOC Garden State Chapter Dr. Richard H. Wittstruck

Field-Based Risk Reduction Presented to AOC Garden State Chapter Dr. Richard H. Wittstruck Associate Director Joint Base McGuire-Dix-Lakehurst 10 February 2016 APPROVED: PUBLIC RELEASE 10 February 2016 1 Field-Based Risk Reduction Mission

124 views • 10 slides
MUL TI -DISC IPLINARY RISK IDENTIFIC ATION AND EVALUATION FOR THE TIDAL INDUSTRY Athanasi sios

MUL TI -DISC IPLINARY RISK IDENTIFIC ATION AND EVALUATION FOR THE TIDAL INDUSTRY Athanasi sios

MUL TI -DISC IPLINARY RISK IDENTIFIC ATION AND EVALUATION FOR THE TIDAL INDUSTRY Athanasi sios s J K olios Lecturer in E ngineering Risk Analysis Geo eorge W . Rea ead Researcher Anas astas asia a K . Io Ioannou Researcher

279 views • 17 slides
Risk sk s strat tratif ific icat ation a and nd inc ncidenc nce o e of f acute c e

Risk sk s strat tratif ific icat ation a and nd inc ncidenc nce o e of f acute c e

Risk sk s strat tratif ific icat ation a and nd inc ncidenc nce o e of f acute c e complic icat atio ions s in n upper e r extrem remit ity d deep ep v vein in th thrombosis sis (U (UEDVT) ) patie tient nts. s. Dr.

798 views • 45 slides
Co mpe te nc y-Base d T e ac he r De ve lo pme nt o n ICT in Ne pal NE PAL South Asia Re g

Co mpe te nc y-Base d T e ac he r De ve lo pme nt o n ICT in Ne pal NE PAL South Asia Re g

Go ve rnme nt o f Ne pa l Ministr y of E duc ation Co mpe te nc y-Base d T e ac he r De ve lo pme nt o n ICT in Ne pal NE PAL South Asia Re g iona l Symposium on ICT for E duc a tion (SARSIE ) 2018 27-28 F e b rua ry 2018, Co lo mb

616 views • 16 slides
Ross ss C. Brownson nson Washin hingt gton on Uni Univer ersity sity in St. . Louis is

Ross ss C. Brownson nson Washin hingt gton on Uni Univer ersity sity in St. . Louis is

Ho How do I o I bui uild d an e n evidence dence-base based d he healt lth h dep epar artment? tment? Ten enness nessee ee Pub ublic lic Hea ealth lth Associ ociation ation Ann nnual ual Conf nference erence Sept

581 views • 43 slides
Tokeni z ation and Lemmati z ation FE ATU R E E N G IN E E R IN G FOR N L P IN P YTH ON Ro u

Tokeni z ation and Lemmati z ation FE ATU R E E N G IN E E R IN G FOR N L P IN P YTH ON Ro u

Tokeni z ation and Lemmati z ation FE ATU R E E N G IN E E R IN G FOR N L P IN P YTH ON Ro u nak Banik Data Scientist Te x t so u rces Ne w s articles T w eets Comments FEATURE ENGINEERING FOR NLP IN PYTHON Making te x t machine friendl y

983 views • 35 slides
Mau aus in in th the C e Clas assroom sroom: : A A Comi mic-based based Cit itat ation

Mau aus in in th the C e Clas assroom sroom: : A A Comi mic-based based Cit itat ation

Mau aus in in th the C e Clas assroom sroom: : A A Comi mic-based based Cit itat ation ion Pe Pedag agogy ogy Aree Metz Washington State University a.metz@wsu.edu A Pedagogy of Multiliteracies We argue that literacy pedagogy

278 views • 17 slides
The application of risk assessment in food safety control in Risk Risk Assessment Management

The application of risk assessment in food safety control in Risk Risk Assessment Management

Risk Analysis Framework The application of risk assessment in food safety control in Risk Risk Assessment Management mainland China Science based Policy based Junshi Chen, M.D. Risk Communication I nstitute of Nutrition

442 views • 6 slides
Relati v e Val u ation E QU ITY VAL U ATION IN R Cli Ang Senior Vice President , Compass Le

Relati v e Val u ation E QU ITY VAL U ATION IN R Cli Ang Senior Vice President , Compass Le

Relati v e Val u ation E QU ITY VAL U ATION IN R Cli Ang Senior Vice President , Compass Le x econ La w of One Price Relati v e v al u ation is based on the La w of One Price , i . e ., t w o assets that look the same m u st ha v e the price

383 views • 21 slides
Physical and Data Link Layer Kameswari Chebrolu Dept. of Electrical Engineering, IIT Kanpur

Physical and Data Link Layer Kameswari Chebrolu Dept. of Electrical Engineering, IIT Kanpur

Physical and Data Link Layer Kameswari Chebrolu Dept. of Electrical Engineering, IIT Kanpur Problem Statement Make two computers talk to each other Pictures courtesy Peterson &amp; Davie Encoding Physical media transmit Analog signals

208 views • 19 slides
SMTP is close to being the perfect application protocol: it solves a large, important problem

SMTP is close to being the perfect application protocol: it solves a large, important problem

106 views • 7 slides
Computer Networks An Open Source Approach Chapter 3: Link Layer Ying-Dar Lin, Ren-Hung Hwang,

Computer Networks An Open Source Approach Chapter 3: Link Layer Ying-Dar Lin, Ren-Hung Hwang,

Computer Networks An Open Source Approach Chapter 3: Link Layer Ying-Dar Lin, Ren-Hung Hwang, Fred Baker Chapter 3: Link Layer 1 Content 3.1 General issues 3.2 Point-to-point protocol 3.3 Ethernet (IEEE 802.3) 3.4 Wireless

1.36k views • 114 slides
CcompSci 356 Computer Network Architecture Lecture 25: Final review Xiaowei Yang

CcompSci 356 Computer Network Architecture Lecture 25: Final review Xiaowei Yang

CcompSci 356 Computer Network Architecture Lecture 25: Final review Xiaowei Yang xwy@cs.duke.edu What we have learned Key components of the Internet What happens when data is sent from one host to another What the Internet looks like

932 views • 49 slides
How to Rank Your Website on Page #1 of Google SEARCH ENGINE OPTIMISATION (SEO) Topics Covered

How to Rank Your Website on Page #1 of Google SEARCH ENGINE OPTIMISATION (SEO) Topics Covered

Equinet Academy How to Rank Your Website on Page #1 of Google SEARCH ENGINE OPTIMISATION (SEO) Topics Covered 1 Introduction 2 Keyword Research 3 On-Page SEO 4 Off-Page SEO 5 SEO Analytics Search Engine Optimization (SEO) Training

1.09k views • 94 slides
Data Link Layer: Part 2 Data Link Layer Functions: Recap Point-to-Point Data Link

Data Link Layer: Part 2 Data Link Layer Functions: Recap Point-to-Point Data Link

Data Link Layer: Part 2 Data Link Layer Functions: Recap Point-to-Point Data Link Protocols Broadcast LAN and Media Access Control Taxonomy of MAC Protocols Static Partitions: TDMA, FDMA, CDMA, etc. (Demand

799 views • 65 slides
Energy Tips Georgetown ISD Energy Management Energy Tips Building Envelope: Air Leaks Inadequate

Energy Tips Georgetown ISD Energy Management Energy Tips Building Envelope: Air Leaks Inadequate

Georgetown ISD Energy Management Energy Tips Georgetown ISD Energy Management Energy Tips Building Envelope: Air Leaks Inadequate seals around windows and doors can allow air to enter/escape our indoor environment, requiring HVAC equipment to

253 views • 23 slides
Physics 115 General Physics II Session 20 Capacitors Dielectrics R. J. Wilkes Email:

Physics 115 General Physics II Session 20 Capacitors Dielectrics R. J. Wilkes Email:

Physics 115 General Physics II Session 20 Capacitors Dielectrics R. J. Wilkes Email: phy115a@u.washington.edu Home page: http://courses.washington.edu/phy115a/ 5/5/14 1 Lecture Schedule (up to exam 2) Today 5/5/14 Physics 115

489 views • 21 slides

More recommend