PASSWORDS CS682: Advanced Security Topics Vasiliki Panteli - PowerPoint PPT Presentation

PASSWORDS CS682: Advanced Security Topics Vasiliki Panteli 3/9/2020 Passwords 1

Passwords • Passwords is a user authentication mechanism that is widely adopted for many years • Methods for user authentication: • Something you know (password) • Something you have (mobile phone) • Something you are (biometrics) 3/9/2020 Passwords 2

1 st Paper: The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Scheme Bonneau J., Herley C., Van Oorschot P. C., Stajano F. 3/9/2020 Passwords 3

1 st Paper Overview • Introduction • Problem • Proposal • Framework Analysis • Properties • Weights • Schemes Evaluation • Conclusion 3/9/2020 Passwords 4

Introduction – Problem • Passwords are plagued with security problems • Passwords are not replaced by any of the numerous proposals from the research community 3/9/2020 Passwords 5

Introduction – Proposal • The authors propose a framework which provides an evaluation of already proposed password-replacement schemes • It can be used as a benchmark for future password replacement proposals • 25 different properties where tested against 35 password- replacement schemes (9 of them are analyzed in the paper) 3/9/2020 Passwords 6

Framework Analysis - Benefits • Each scheme is rated as either offering or not offering the benefit • Example of “Quasi”: • Memorywise-Effortless: Users of the scheme do not have to remember any secrets at all. • Quasi-Memorywise-Effortless: Users have to remember one secret for everything. • Framework analysis has 3 categories: Usability, Deployability, Security 3/9/2020 Passwords 7

Properties – Usability 1. Memorywise-Effortless 2. Scalable-for-Users 3. Nothing-to-Carry 4. Physically-Effortless 5. Easy-to-Learn 6. Efficient-to-Use 7. Infrequent-Errors 8. Easy-Recovery-from-Loss 3/9/2020 Passwords 8

Properties – Deployability 1. Accessible 2. Negligible-Cost-per-User 3. Server-Compatible 4. Browser-Compatible 5. Mature 6. Non-Proprietary 3/9/2020 Passwords 9

Properties – Security 1. Resilient-to-Physical-Observation 2. Resilient-to-Targeted-Impersonation 3. Resilient-to-Throttled-Guessing 4. Resilient-to-Unthrottled-Guessing 5. Resilient-to-Internal-Observation 3/9/2020 Passwords 10

Properties – Security 6. Resilient-to-Leaks-from-Other-Verifiers 7. Resilient-to-Phishing 8. Resilient-to-Theft 9. No-Trusted-Third-Party 10. Requiring-Explicit-Consent 11. Unlinkable 3/9/2020 Passwords 11

Weights • Some benefits are more important than others depending on the specific goal for which the scheme is being compared STEP1 • Examine and score each individual scheme on each benefit • Compare competing schemes to identify precisely which benefits each offers over the other STEP2 • Determinate a ranking with weights that take into account the relative importance of the benefit STEP3 3/9/2020 Passwords 12

Weights 3/9/2020 Passwords 13

Evaluation – Legacy Passwords ARE ARE NOT 1. Nothing-to-Carry 1. Memory-Effortless 2. Easy-to-Learn 2. Scalable-for-Users 3. Efficient-to-Use 3. Physically-Effortless 4. Easy-Recovery-from-Lost 4. Resilient-to-Physical-Observation 5. Accessible 5. Resilient-to-Throttled-Guessing 6. Negligible-Cost-per-User 6. Resilient-to-Unthrottled-Guessing 7. Server-Compatible 7. Resilient-to-Internal-Observation 8. Browser-Compatible 8. Resilient-to-Leaks-from-Other-Verifiers 9. Mature 9. Resilient-to-Phishing 10.Non-Proprietary 11.Resilient-to-Theft 12.No-Trusted-Third-Party 13.Unlinkable 3/9/2020 Passwords 14

Evaluation – Encrypted password managers: Mozilla Firefox Website 1 password master password Mozilla Firefox Website 2 User password Website 3 password 3/9/2020 Passwords 15

Evaluation – Encrypted password managers: Mozilla Firefox IS IS NOT 1. Scalable-for-Users 1. Easy-Recovery-from-Loss 2. Easy-to-Learn 2. Resilient-to-Throttled-Guessing 3. Efficient-to-Use 3. Resilient-to-Unthrottled-Guessing 4. Infrequent-Errors 4. Resilient-to-Internal-Observation 5. Resilient-to-Phishing 5. Resilient-to-Leaks-from-Other-Verifiers 6. Resilient-to-Theft 6. Browser-Compatible 7. No-Trusted-Third-Party 8. Requiring-Explicit-Consent 9. Unlinkable 10. Negligible-Cost-per-User 11. Mature 12. Accessible 13. Server-Compatible 14. Non-Proprietary 15. Quasi-Memorywise-Effortless 16. Quasi-Nothing-To-Carry 17. Quasi-Physically-Effortless 18. Quasi-Resilient-to-Physical-Observation 19. Quasi-Resilient-to-Targeted-Impersonation 3/9/2020 Passwords 16

Evaluation – Federated Single Sign-On: OpenID Website 1 Single Sign-On Website 2 User Website 3 3/9/2020 Passwords 17

Evaluation – Federated Single Sign-On: OpenID IS IS NOT 1. Scalable-for-Users 1. Server-Compatible 2. Nothing-to-Carry 2. Resilient-to-Internal-Observation 3. Efficient-to-Use 3. Resilient-to-Phishing 4. Infrequent-Errors 4. Unlinkable 5. Easy-Recovery-from-Loss 5. No-Trusted-Third-Party 6. Accessible 7. Negligible-Cost-per-User 8. Mature 9. Non-Proprietary 10. Browser-Compatible 11. Quasi-Memorywise-Effortless 12. Quasi-Physically-Effortless 13. Quasi-Easy-to-Learn 14. Resilient-to-Leaks-from-Other-Verifiers 15. Quasi-Resilient-to-Throttled-Guessing 16. Quasi-Resilient-to-Unthrottled-Guessing 17. Quasi-Resilient-to-Targeted-Impersonation 18. Quasi-Resilient-to-Physical-Observation 3/9/2020 Passwords 18

Evaluation – Graphical Passwords: PCCP User Login 3/9/2020 Passwords 19

Evaluation – Graphical Passwords: PCCP IS IS NOT 1. Easy-to-Learn 1. Memorywise-Effortless 2. Negligible-Cost-per-User 2. Scalable-for-Users 3. Browser-Compatible 3. Accessible 4. Non-Proprietary 4. Server-Compatible 5. Resilient-to-Targeted-Impersonation 5. Mature 6. Resilient-to-Leaks-from-Other-Verifiers 6. Resilient-to-Physical-Observation 7. Resilient-to-Phishing 7. Resilient-to-Unthrottled-Guessing 8. Unlinkable 8. Resilient-to-Internal-Observation 3/9/2020 Passwords 20

Evaluation – Cognitive authentication: GrIDsure 2 4 5 6 4 6 8 0 5 4 Write the pattern Choose a pattern User User 9 6 4 6 7 8 5 4 7 9 5 7 8 0 5 3/9/2020 Passwords 21

Evaluation – Cognitive authentication: GrIDsure IS IS NOT 1. Nothing-to-Carry 1. Memory-Effortless 2. Easy-to-Learn 2. Scalable-for-Users 3. Easy-Recovery-from-Lost 3. Physically-Effortless 4. Negligible-Cost-per-User 4. Accessible 5. Browser-Compatible 5. Server-Compatible 6. Resilient-to-Targeted-Impersonation 6. Mature 7. Resilient-to-Throttled-Guessing 7. Non-Proprietary 8. Resilient-to-Unthrottled-Guessing 8. Resilient-to-Physical-Observation 9. Quasi- Efficient-to-Use 9. Resilient-to-Internal-Observation 3/9/2020 Passwords 22

Evaluation – Other schemes 1. Proxy – Based: URRSA 2. Paper tokens: OTPW 3. Hardware tokens: RSA SecureID 4. Mobile-Phone-based: Phoolproof 5. Biometrics: Fingerprint recognition 3/9/2020 Passwords 23

3/9/2020 Passwords 24

Conclusions • Most schemes do better than passwords on security • Every scheme does worse than passwords on deployability • This paper can help research community to evaluate their user authentication proposal using this framework and adjusting it to their needs: • Add weights • Add more benefits 3/9/2020 Passwords 25

2 nd Paper: The Tangled Web of Password Reuse Das, A., Bonneau, J., Caesar, M., Borisov, N., & Wang, X. (2014, February) 3/9/2020 Passwords 26

2 nd Paper Overview • Introduction • Relative Work • Measurement Study • Survey • Guessing Algorithm • Conclusions 3/9/2020 Passwords 27

Introduction • In this paper the authors: • Estimate the rate of password reuse • Examine how reusing passwords can benefit the attackers • Analyze the similarity of non-identical passwords • Developed a password-guessing algorithm 3/9/2020 Passwords 28

Relative Work • Zhang et al. • Drawback: Their password analysis is based on a single source so they examine one password composition policy • Florencio et al. • Drawback: Only considered identical passwords and not related ones (with modifications) • Weir et al. • Drawback: Focus on cracking passwords in an offline scenario 3/9/2020 Passwords 29

• A typical Internet user estimated to have 25 distinct online account • Users often reuse passwords across accounts on different online service 3/9/2020 Passwords 30

Measurement Study • Understand how often users reuse passwords across sites • Understand the specific approaches the users use to vary their password at different sites • In the measurement study the authors take into consideration the password composition policies 3/9/2020 Passwords 31

Password Composition policies • In order to increase the security over the websites, online services often use composition policies or metrics, as it is proven that they do help users to choose stronger passwords. • Example: • Passwords must not contain the user’s entire name/user ID • At least n characters • Passwords must contain characters from two or more of the following categories: • Uppercase characters • Lowercase characters • Base 10 digits • Non-alphanumeric ASCII characters 3/9/2020 Passwords 32