User authentication on the web Joseph Bonneau - - PowerPoint PPT Presentation
User authentication on the web Joseph Bonneau Computer Laboratory Part II Security lecture 2012 J. Bonneau (U. of Cambridge) User authentication on the web February 22, 2012 1 / 41
Computer Laboratory
User authentication on the web February 22, 2012 1 / 41
1
2
3
4
User authentication on the web February 22, 2012 1 / 41
User authentication on the web February 22, 2012 2 / 41
User authentication on the web February 22, 2012 2 / 41
User authentication on the web February 22, 2012 3 / 41
User authentication on the web February 22, 2012 3 / 41
User authentication on the web February 22, 2012 3 / 41
100 200 300 400 500 Traffic rank 0.0 0.2 0.4 0.6 0.8 1.0 Proportion of sites collecting passwords
User authentication on the web February 22, 2012 3 / 41
1
1
Criminals (may know target)
2
Malware
3
Rogue servers
4
Phishers
2
1
Easy for users
2
Cheap for servers
3
Easy to implement
4
Widely compatible
3
1
Users choose to reveal identity
2
Easy to create new identities
3
Malicious sites get no information
4
1
non-repudiable (sometimes)
2
tracable (sometimes)
User authentication on the web February 22, 2012 4 / 41
1
2
3
4
User authentication on the web February 22, 2012 4 / 41
Wall Street Journal, 1996 Wall Street Journal, 2010
User authentication on the web February 22, 2012 5 / 41
User authentication on the web February 22, 2012 5 / 41
User authentication on the web February 22, 2012 5 / 41
User authentication on the web February 22, 2012 5 / 41
User authentication on the web February 22, 2012 6 / 41
User authentication on the web February 22, 2012 6 / 41
User authentication on the web February 22, 2012 6 / 41
User authentication on the web February 22, 2012 6 / 41
User authentication on the web February 22, 2012 7 / 41
User authentication on the web February 22, 2012 7 / 41
User authentication on the web February 22, 2012 7 / 41
User authentication on the web February 22, 2012 8 / 41
User authentication on the web February 22, 2012 8 / 41
User authentication on the web February 22, 2012 9 / 41
User authentication on the web February 22, 2012 10 / 41
User authentication on the web February 22, 2012 10 / 41
1
2
3
1
Technical failures (false authentication)
2
User interface failures
3
Human memory failures
4
Economic failures
5
Technical failures (unintended authentication)
4
User authentication on the web February 22, 2012 11 / 41
User authentication on the web February 22, 2012 12 / 41
User authentication on the web February 22, 2012 13 / 41
User authentication on the web February 22, 2012 13 / 41
User authentication on the web February 22, 2012 14 / 41
User authentication on the web February 22, 2012 14 / 41
User authentication on the web February 22, 2012 14 / 41
User authentication on the web February 22, 2012 14 / 41
User authentication on the web February 22, 2012 15 / 41
User authentication on the web February 22, 2012 15 / 41
User authentication on the web February 22, 2012 16 / 41
User authentication on the web February 22, 2012 16 / 41
User authentication on the web February 22, 2012 16 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
Fu et al., 2001
User authentication on the web February 22, 2012 17 / 41
User authentication on the web February 22, 2012 18 / 41
User authentication on the web February 22, 2012 18 / 41
User authentication on the web February 22, 2012 19 / 41
User authentication on the web February 22, 2012 19 / 41
User authentication on the web February 22, 2012 19 / 41
User authentication on the web February 22, 2012 19 / 41
1
2
3
1
Technical failures (false authentication)
2
User interface failures
3
Human memory failures
4
Economic failures
5
Technical failures (unintended authentication)
4
User authentication on the web February 22, 2012 20 / 41
(a) Hand tracking analysis. Rectangles identify regions in movement. Black rectangles are used for movements in the hands regions, grey rectangles for keys, white rectangles for regions where both hand and key movement happens. These rectangles identify likely key pressings. (b) Key pressing analysis. Using occlusion-based techniques, the analysis determines keys that are not pressed, which are represented by the dark polygons.
Balzarotti et al. 2008
User authentication on the web February 22, 2012 21 / 41
Hardware keylogger, US$36
User authentication on the web February 22, 2012 21 / 41
Software keylogger, US$49.50
User authentication on the web February 22, 2012 21 / 41
Phishing (Firefox)
User authentication on the web February 22, 2012 21 / 41
1
2
3
1
Technical failures (false authentication)
2
User interface failures
3
Human memory failures
4
Economic failures
5
Technical failures (unintended authentication)
4
User authentication on the web February 22, 2012 22 / 41
123456 12345 123456789 password iloveyou princess 1234567 rockyou 12345678 abc123 nicole daniel babygirl monkey lovely jessica 654321 michael
User authentication on the web February 22, 2012 23 / 41
User authentication on the web February 22, 2012 23 / 41
User authentication on the web February 22, 2012 23 / 41
User authentication on the web February 22, 2012 23 / 41
User authentication on the web February 22, 2012 23 / 41
User authentication on the web February 22, 2012 23 / 41
0.0 0.2 0.4 0.6 0.8 1.0 success rate α 5 10 15 20 25 30 35 marginal work ˜ µα (bits)
Yahoo! [2011] Battlefield Heroes [2011] Gawker [2010] RockYou [2009] Morris [79] Klein [90]
User authentication on the web February 22, 2012 23 / 41
User authentication on the web February 22, 2012 24 / 41
Used against Sarah Palin in 2008
Griffith et. al: 30% of individual’s mother’s maiden names
Schecter et. al: ∼ 25% of questions guessed by friends, family
User authentication on the web February 22, 2012 24 / 41
25% surname 10% forename 15% pet name 20% place name
❲❤❛t ✐s ♠② ❢❛✈♦✉r✐t❡ ❝♦❧♦✉r❄ ❲❤❛t ✐s t❤❡ ✇♦rst ❞❛② ♦❢ t❤❡ ✇❡❡❦❄
User authentication on the web February 22, 2012 24 / 41
0.0 0.2 0.4 0.6 0.8 1.0 success rate α 5 10 15 20 25 30 35 40 marginal guesswork ˜ µα
Forename Surname Password [RockYou] Password [Klein] Password [Spafford] Password [Schneier]
Personal knowledge worse than passwords (Bonneau et al. 2010)
User authentication on the web February 22, 2012 24 / 41
1
2
3
1
Technical failures (false authentication)
2
User interface failures
3
Human memory failures
4
Economic failures
5
Technical failures (unintended authentication)
4
User authentication on the web February 22, 2012 25 / 41
100 200 300 400 500 Traffic rank 0.0 0.2 0.4 0.6 0.8 1.0 Proportion of sites collecting passwords
Naming Liveness checks Password recovery
User authentication on the web February 22, 2012 26 / 41
Naming Liveness checks Password recovery
User authentication on the web February 22, 2012 26 / 41
User authentication on the web February 22, 2012 27 / 41
User authentication on the web February 22, 2012 27 / 41
100 200 300 400 500 Traffic rank 0.0 0.2 0.4 0.6 0.8 1.0 Proportion of sites collecting passwords
Average person has > 25 accounts (Flôrencio et al., 2007)
Email accounts becoming powerful credentials
User authentication on the web February 22, 2012 28 / 41
10 1E-2 1E-1 1E+0 1E+1 1E+2 1E+3 1E+4 1E+5 password score page views per million E-commerce News/Customization User interaction
Average person has > 25 accounts (Flôrencio et al., 2007)
Email accounts becoming powerful credentials
User authentication on the web February 22, 2012 28 / 41
Average person has > 25 accounts (Flôrencio et al., 2007)
Email accounts becoming powerful credentials
User authentication on the web February 22, 2012 28 / 41
Average person has > 25 accounts (Flôrencio et al., 2007)
Email accounts becoming powerful credentials
User authentication on the web February 22, 2012 28 / 41
1
2
3
1
Technical failures (false authentication)
2
User interface failures
3
Human memory failures
4
Economic failures
5
Technical failures (unintended authentication)
4
User authentication on the web February 22, 2012 29 / 41
1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
Narayanan 2009 1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
Narayanan 2009 1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
Bortz et al. 2007 1
2
3
4
5
User authentication on the web February 22, 2012 30 / 41
1
2
3
4
User authentication on the web February 22, 2012 31 / 41
User authentication on the web February 22, 2012 32 / 41
User authentication on the web February 22, 2012 32 / 41
User authentication on the web February 22, 2012 32 / 41
0.0 0.2 0.4 0.6 0.8 1.0 success rate α 5 10 15 20 25 30 35 40 marginal guesswork ˜ µα
Forename Surname Password [RockYou] Password [Klein] Password [Spafford] Password [Schneier] Mnemonic [Kuo] Pass-Go PassPoints Passfaces
User authentication on the web February 22, 2012 32 / 41
User authentication on the web February 22, 2012 33 / 41
User authentication on the web February 22, 2012 33 / 41
0.0 0.2 0.4 0.6 0.8 1.0 success rate α 5 10 15 20 25 30 35 40 marginal guesswork ˜ µα
Forename Surname Password [RockYou] Password [Klein] Password [Spafford] Password [Schneier] Mnemonic [Kuo]
User authentication on the web February 22, 2012 33 / 41
User authentication on the web February 22, 2012 33 / 41
t✇ttr✳❇❆◆◆❊❉❴P❆❙❙❲❖❘❉❙ ❂ ❬ ✧✵✵✵✵✵✵✧✱ ✧✶✶✶✶✶✶✧✱ ✧✶✶✶✶✶✶✶✶✧✱ ✧✶✶✷✷✸✸✧✱ ✧✶✷✶✷✶✷✧✱ ✧✶✷✸✶✷✸✧✱ ✧✶✷✸✹✺✻✧✱ ✧✶✷✸✹✺✻✼✧✱ ✧✶✷✸✹✺✻✼✽✧✱ ✧✶✷✸✹✺✻✼✽✾✧✱ ✧✶✸✶✸✶✸✧✱ ✧✷✸✷✸✷✸✧✱ ✧✻✺✹✸✷✶✧✱ ✧✻✻✻✻✻✻✧✱ ✧✻✾✻✾✻✾✧✱ ✧✼✼✼✼✼✼✧✱ ✧✼✼✼✼✼✼✼✧✱ ✧✽✻✼✺✸✵✾✧✱ ✧✾✽✼✻✺✹✧✱ ✧❛❛❛❛❛❛✧✱ ✧❛❜❝✶✷✸✧✱ ✧❛❜❝✶✷✸✧✱ ✧❛❜❝❞❡❢✧✱ ✧❛❜❣rt②✉✧✱ ✧❛❝❝❡ss✧✱ ✧❛❝❝❡ss✶✹✧✱ ✧❛❝t✐♦♥✧✱ ✧❛❧❜❡rt✧✱ ✧❛❧❜❡rt♦✧✱ ✧❛❧❡①✐s✧✱ ✧❛❧❡❥❛♥❞r❛✧✱ ✧❛❧❡❥❛♥❞r♦✧✱ ✧❛♠❛♥❞❛✧✱ ✧❛♠❛t❡✉r✧✱ ✧❛♠❡r✐❝❛✧✱ ✧❛♥❞r❡❛✧✱ ✧❛♥❞r❡✇✧✱ ✧❛♥❣❡❧❛✧✱ ✧❛♥❣❡❧s✧✱ ✧❛♥✐♠❛❧✧✱ ✧❛♥t❤♦♥②✧✱ ✧❛♣♦❧❧♦✧✱ ✧❛♣♣❧❡s✧✱ ✧❛rs❡♥❛❧✧✱ ✧❛rt❤✉r✧✱ ✧❛s❞❢❣❤✧✱ ✧❛s❞❢❣❤✧✱ ✧❛s❤❧❡②✧✱ ✧❛ss❤♦❧❡✧✱ ✧❛✉❣✉st✧✱ ✧❛✉st✐♥✧✱ ✧❜❛❞❜♦②✧✱ ✧❜❛✐❧❡②✧✱ ✧❜❛♥❛♥❛✧✱ ✧❜❛r♥❡②✧✱ ✧❜❛s❡❜❛❧❧✧✱ ✧❜❛t♠❛♥✧✱ ✧❜❡❛tr✐③✧✱ ✧❜❡❛✈❡r✧✱ ✧❜❡❛✈✐s✧✱ ✧❜✐❣❝♦❝❦✧✱ ✧❜✐❣❞❛❞❞②✧✱ ✧❜✐❣❞✐❝❦✧✱ ✧❜✐❣❞♦❣✧✱ ✧❜✐❣t✐ts✧✱ ✧❜✐r❞✐❡✧✱ ✧❜✐t❝❤❡s✧✱ ✧❜✐t❡♠❡✧✱ ✧❜❧❛③❡r✧✱ ✧❜❧♦♥❞❡✧✱ ✧❜❧♦♥❞❡s✧✱ ✧❜❧♦✇❥♦❜✧✱ ✧❜❧♦✇♠❡✧✱ ✧❜♦♥❞✵✵✼✧✱ ✧❜♦♥✐t❛✧✱ ✧❜♦♥♥✐❡✧✱ ✧❜♦♦❜♦♦✧✱ ✧❜♦♦❣❡r✧✱ ✧❜♦♦♠❡r✧✱ ✧❜♦st♦♥✧✱ ✧❜r❛♥❞♦♥✧✱ ✧❜r❛♥❞②✧✱ ✧❜r❛✈❡s✧✱ ✧❜r❛③✐❧✧✱ ✧❜r♦♥❝♦✧✱ ✧❜r♦♥❝♦s✧✱ ✧❜✉❧❧❞♦❣✧✱ ✧❜✉st❡r✧✱ ✧❜✉tt❡r✧✱ ✧❜✉tt❤❡❛❞✧✱ ✧❝❛❧✈✐♥✧✱ ✧❝❛♠❛r♦✧✱ ✧❝❛♠❡r♦♥✧✱ ✧❝❛♥❛❞❛✧✱ ✧❝❛♣t❛✐♥✧✱ ✧❝❛r❧♦s✧✱ ✧❝❛rt❡r✧✱ ✧❝❛s♣❡r✧✱ ✧❝❤❛r❧❡s✧✱ ✧❝❤❛r❧✐❡✧✱ ✧❝❤❡❡s❡✧✱ ✧❝❤❡❧s❡❛✧✱ ✧❝❤❡st❡r✧✱ ✧❝❤✐❝❛❣♦✧✱ ✧❝❤✐❝❦❡♥✧✱ ✧❝♦❝❛❝♦❧❛✧✱ ✧❝♦❢❢❡❡✧✱ ✳✳✳ ✧t❡q✉✐❡r♦✧✱ ✧t❛②❧♦r✧✱ ✧t❡♥♥✐s✧✱ ✧t❡r❡s❛✧✱ ✧t❡st❡r✧✱ ✧t❡st✐♥❣✧✱ ✧t❤❡♠❛♥✧✱ ✧t❤♦♠❛s✧✱ ✧t❤✉♥❞❡r✧✱ ✧t❤①✶✶✸✽✧✱ ✧t✐❢❢❛♥②✧✱ ✧t✐❣❡rs✧✱ ✧t✐❣❣❡r✧✱ ✧t♦♠❝❛t✧✱ ✧t♦♣❣✉♥✧✱ ✧t♦②♦t❛✧✱ ✧tr❛✈✐s✧✱ ✧tr♦✉❜❧❡✧✱ ✧tr✉st♥♦✶✧✱ ✧t✉❝❦❡r✧✱ ✧t✉rt❧❡✧✱ ✧t✇✐tt❡r✧✱ ✧✉♥✐t❡❞✧✱ ✧✈❛❣✐♥❛✧✱ ✧✈✐❝t♦r✧✱ ✧✈✐❝t♦r✐❛✧✱ ✧✈✐❦✐♥❣✧✱ ✧✈♦♦❞♦♦✧✱ ✧✈♦②❛❣❡r✧✱ ✧✇❛❧t❡r✧✱ ✧✇❛rr✐♦r✧✱ ✧✇❡❧❝♦♠❡✧✱ ✧✇❤❛t❡✈❡r✧✱ ✧✇✐❧❧✐❛♠✧✱ ✧✇✐❧❧✐❡✧✱ ✧✇✐❧s♦♥✧✱ ✧✇✐♥♥❡r✧✱ ✧✇✐♥st♦♥✧✱ ✧✇✐♥t❡r✧✱ ✧✇✐③❛r❞✧✱ ✧①❛✈✐❡r✧✱ ✧①①①①①①✧✱ ✧①①①①①①①①✧✱ ✧②❛♠❛❤❛✧✱ ✧②❛♥❦❡❡✧✱ ✧②❛♥❦❡❡s✧✱ ✧②❡❧❧♦✇✧✱ ✧③①❝✈❜♥✧✱ ✧③①❝✈❜♥♠✧✱ ✧③③③③③③✧❪❀
User authentication on the web February 22, 2012 33 / 41
User authentication on the web February 22, 2012 33 / 41
User authentication on the web February 22, 2012 33 / 41
User authentication on the web February 22, 2012 34 / 41
User authentication on the web February 22, 2012 34 / 41
User authentication on the web February 22, 2012 34 / 41
User authentication on the web February 22, 2012 34 / 41
User authentication on the web February 22, 2012 35 / 41
Schecther et al. 2008
User authentication on the web February 22, 2012 35 / 41
Schecther et al. 2008
User authentication on the web February 22, 2012 35 / 41
User authentication on the web February 22, 2012 35 / 41
User authentication on the web February 22, 2012 35 / 41
User authentication on the web February 22, 2012 36 / 41
User authentication on the web February 22, 2012 36 / 41
User authentication on the web February 22, 2012 37 / 41
User authentication on the web February 22, 2012 37 / 41
User authentication on the web February 22, 2012 37 / 41
User authentication on the web February 22, 2012 37 / 41
User authentication on the web February 22, 2012 37 / 41
User authentication on the web February 22, 2012 37 / 41
User authentication on the web February 22, 2012 37 / 41
User authentication on the web February 22, 2012 38 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 39 / 41
User authentication on the web February 22, 2012 40 / 41
100 200 300 400 500 Traffic rank 0.0 0.2 0.4 0.6 0.8 1.0 Proportion of sites collecting passwords
Passwords collected Bugmenot sharing blocked
User authentication on the web February 22, 2012 40 / 41
User authentication on the web February 22, 2012 41 / 41