CoChat
Sign Up
Cited by 19User Authentication and Security SystemsAdvanced Authentication Protocols SecurityWeb Application Security Vulnerabilities

The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.

Bypassing Push-based Second Factor and Passwordless Authentication with Human-Indistinguishable Notifications

Jubur, Mohammed, Shrestha, Prakash, Saxena, Nitesh, Prakash, Jay·2021·Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security
DOI 10.1145/3433210.3453084
Open this paper in CoChat — free account

Abstract

Second factor (2FA) or passwordless authentication based on notifications pushed to a user's personal device (e.g., a phone) that the user can simply approve (or deny) has become widely popular due to its convenience. In this paper, we show that the effortlessness of this approach gives rise to a fundamental design vulnerability. The vulnerability stems from the fact that the notification, as shown to the user, is not uniquely bound to the user's login session running through the browser, and thus if two notifications are sent around the same time (one for the user's session and one for an attacker's session), the user may not be able to distinguish between the two, likely ending up accepting the notification of the attacker's session.

Overview

Integrity signals

Registry

Crossref · 10.1145/3433210.3453084

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Citations

Cites

Research works printed but not linked: 40

  1. Elizabeth Arens . 2019. Best times to post on social media for 2019 . https: //bit.ly/2J7cfLr. (2019). Last accessed Feb 28, 2020. Elizabeth Arens. 2019. Best times to post on social media for 2019. https: //bit.ly/2J7cfLr. (2019). Last accessed Feb 28, 2020.
  2. Authy. 2019 . Authy 2FA -- OneTouch. https://www.twilio.com/authy/features/ push. (2019) . Accessed : April 22, 2019. Authy. 2019. Authy 2FA -- OneTouch. https://www.twilio.com/authy/features/ push. (2019). Accessed: April 22, 2019.
  3. Ben Ku. 2018. Does HTTPS Protect Your Privacy? shorturl.at/efA26. (2018). Accessed : Sep 2, 2019 . Ben Ku. 2018. Does HTTPS Protect Your Privacy? shorturl.at/efA26. (2018). Accessed: Sep 2, 2019.
  4. CIMB Bank Berhad . 2019. Secure TAC | CIMB Clicks Malayasia . https://bit.ly/ 2LCXroC. (2019). Last accessed May 13, 2019 . CIMB Bank Berhad. 2019. Secure TAC | CIMB Clicks Malayasia. https://bit.ly/ 2LCXroC. (2019). Last accessed May 13, 2019.
  5. Malayan Banking Berhad . 2019. Secure 2u | Digital Products and Services. https://bit.ly/2LCX51g. (2019). Last accessed May 13, 2019 . Malayan Banking Berhad. 2019. Secure 2u | Digital Products and Services. https://bit.ly/2LCX51g. (2019). Last accessed May 13, 2019.
  6. 10.1109/SP.2012.44 · DOI · Paper page
  7. Colin Lecher . 2019. Facebook app developers leaked millions of user records on cloud servers, researchers say. https://bit.ly/2RlQBE7. (2019). Accessed : Sep 2, 2019 . Colin Lecher. 2019. Facebook app developers leaked millions of user records on cloud servers, researchers say. https://bit.ly/2RlQBE7. (2019). Accessed: Sep 2, 2019.
  8. 10.1145/3173574.3174030 · DOI
  9. Dave Albaugh . 2019 . Common tech support scams: How to identify and avoid them. shorturl.at/pyQY2. (2019) . Accessed : Sep 13, 2019. Dave Albaugh. 2019. Common tech support scams: How to identify and avoid them. shorturl.at/pyQY2. (2019). Accessed: Sep 13, 2019.
  10. Davey Winder . 2019. Unsecured Facebook Databases Leak Data Of 419 Million Users. https://bit.ly/2lR2nd5. (2019). Accessed : Sep 5, 2019 . Davey Winder. 2019. Unsecured Facebook Databases Leak Data Of 419 Million Users. https://bit.ly/2lR2nd5. (2019). Accessed: Sep 5, 2019.
  11. DUO. 2019 . Duo Push: Duo Authentication. shorturl.at/pwE16. (2019) . Accessed : April 21, 2019. DUO. 2019. Duo Push: Duo Authentication. shorturl.at/pwE16. (2019). Accessed: April 21, 2019.
  12. Ewan D. 2017. Enabling 2FA for MSA. (2017). https://bit.ly/2HihL9p Accessed ; Last accessed 11 May , 2019 . EwanD. 2017. Enabling 2FA for MSA. (2017). https://bit.ly/2HihL9p Accessed; Last accessed 11 May, 2019.
  13. Facebook. 2019 . Two-factor authentication for Facebook now easier to set up. https://bit.ly/2MpF3vP. (2019) . Accessed : May 10, 2019. Facebook. 2019. Two-factor authentication for Facebook now easier to set up. https://bit.ly/2MpF3vP. (2019). Accessed: May 10, 2019.
  14. Futurae. 2019. One-Touch. ( 2019 ). https://futurae.com/platform/one-touch/ Accessed ; Last accessed 11 May, 2019. Futurae. 2019. One-Touch. (2019). https://futurae.com/platform/one-touch/ Accessed; Last accessed 11 May, 2019.
  15. Google Inc. 2017 . Google 2-Step Verification. https://www.google.com/landing/ 2step/. (2017) . Accessed : May 13, 2017. Google Inc. 2017. Google 2-Step Verification. https://www.google.com/landing/ 2step/. (2017). Accessed: May 13, 2017.
  16. Amber Gott . 2019. LastPass Authenticator Makes Two-Factor Easy. urlhttps://bit.ly/2HsKbh5. (2019). Accessed ; Last accessed 11 May , 2019 . Amber Gott. 2019. LastPass Authenticator Makes Two-Factor Easy. urlhttps://bit.ly/2HsKbh5. (2019). Accessed; Last accessed 11 May, 2019.
  17. Matt Gutman . 2015. Snapchat hacked: 4.6 million user names, partial phone numbers leaked - ABC15 Arizona. https://bit.ly/2vSSdKZ. (2015). Accessed : May 5, 2019 . Matt Gutman. 2015. Snapchat hacked: 4.6 million user names, partial phone numbers leaked - ABC15 Arizona. https://bit.ly/2vSSdKZ. (2015). Accessed: May 5, 2019.
  18. Identity Automation . 2018 . Two-Factor Authentication (2FA) Explained: Push Notifications. https://bit.ly/3hsxDpO. (2018). Accessed : Mar 01 , 2020 . Identity Automation. 2018. Two-Factor Authentication (2FA) Explained: Push Notifications. https://bit.ly/3hsxDpO. (2018). Accessed: Mar 01, 2020.
  19. Identity Automation . 2019 . Push Authentication using RapidIdentity PingMe. https://bit.ly/2KWvfNj. (2019) . Accessed : April 22, 2019. Identity Automation. 2019. Push Authentication using RapidIdentity PingMe. https://bit.ly/2KWvfNj. (2019). Accessed: April 22, 2019.
  20. International Association of Better Business Bureaus. 2019 . BBB Tip: Tech Support Scams. shorturl.at/dsuBJ. (2019) . Accessed : Sep 13, 2019. International Association of Better Business Bureaus. 2019. BBB Tip: Tech Support Scams. shorturl.at/dsuBJ. (2019). Accessed: Sep 13, 2019.
  21. 10.1145/1572532.1572547 · DOI
  22. Nikolaos Karapanos , Claudio Marforio , Claudio Soriente , and Srdjan Capkun . 2015 . Sound-proof: usable two-factor authentication based on ambient sound . In USENIX Security Symposium. Nikolaos Karapanos, Claudio Marforio, Claudio Soriente, and Srdjan Capkun. 2015. Sound-proof: usable two-factor authentication based on ambient sound. In USENIX Security Symposium.
  23. Mohit Kumar . 2012. Anonymous leaks database from Israeli Musical Act Magazine site #OpIsrael. https://bit.ly/2Y84yqo. (2012). Accessed : May 5, 2019 . Mohit Kumar. 2012. Anonymous leaks database from Israeli Musical Act Magazine site #OpIsrael. https://bit.ly/2Y84yqo. (2012). Accessed: May 5, 2019.
  24. Mohit Kumar . 2012. Bulgarian torrent tracker forum hacked and accused of collecting user IP. https://bit.ly/2VSqLvf. (2012). Accessed : May 5, 2019 . Mohit Kumar. 2012. Bulgarian torrent tracker forum hacked and accused of collecting user IP. https://bit.ly/2VSqLvf. (2012). Accessed: May 5, 2019.
  25. LastPass. 2019 . The only authenticator app you need. https://lastpass.com/auth/. (2019). Accessed : Mar 3 , 2020 . LastPass. 2019. The only authenticator app you need. https://lastpass.com/auth/. (2019). Accessed: Mar 3, 2020.
  26. Laura Hautala . 2019. Instagram website leaked phone numbers and emails for months, researcher says. https://cnet.co/2WjilNz. (2019). Accessed : Sep 2, 2019 . Laura Hautala. 2019. Instagram website leaked phone numbers and emails for months, researcher says. https://cnet.co/2WjilNz. (2019). Accessed: Sep 2, 2019.
  27. 10.3390/fi10020013 · DOI
  28. 10.1145/3308558.3313489 · DOI
  29. RCDevs. 2019 . Multi-Factor with OTP and FIDO-U2F. https://www.rcdevs.com/ products/openotp/. (2019) . Accessed : May 10, 2019. RCDevs. 2019. Multi-Factor with OTP and FIDO-U2F. https://www.rcdevs.com/ products/openotp/. (2019). Accessed: May 10, 2019.
  30. Ken Reese , Trevor Smith , Jonathan Dutson , Jonathan Armknecht , Jacob Cameron , and Kent Seamons . 2019 . A Usability Study of Five Two-Factor Authentication Methods . In Fifteenth Symposium on Usable Privacy and Security ({SOUPS} 2019). Ken Reese, Trevor Smith, Jonathan Dutson, Jonathan Armknecht, Jacob Cameron, and Kent Seamons. 2019. A Usability Study of Five Two-Factor Authentication Methods. In Fifteenth Symposium on Usable Privacy and Security ({SOUPS} 2019).
  31. RSA Security . 2019 . Mobile Authentication | Push Notification. https://bit.ly/ 2UA6wxC. (2019) . Accessed : April 22, 2019. RSA Security. 2019. Mobile Authentication | Push Notification. https://bit.ly/ 2UA6wxC. (2019). Accessed: April 22, 2019.
  32. 10.1145/2500423.2500434 · DOI
  33. 10.1109/ICDCS.2017.64 · DOI
  34. 10.1145/2818000.2818007 · DOI
  35. Anatoly Shusterman , Lachlan Kang , Yarden Haskal , Yosef Meltser , Prateek Mittal , Yossi Oren , and Yuval Yarom . 2019. Robust website fingerprinting through the cache occupancy channel . In 28th {USENIX} Security Symposium (USENIX Security 19). 639--656. Anatoly Shusterman, Lachlan Kang, Yarden Haskal, Yosef Meltser, Prateek Mittal, Yossi Oren, and Yuval Yarom. 2019. Robust website fingerprinting through the cache occupancy channel. In 28th {USENIX} Security Symposium (USENIX Security 19). 639--656.
  36. Nikhil Sonnad . 2015. What's in the Ashley Madison database that hackers released online - Quartz. https://bit.ly/1WFcrP6. (2015). Accessed : May 5, 2019 . Nikhil Sonnad. 2015. What's in the Ashley Madison database that hackers released online - Quartz. https://bit.ly/1WFcrP6. (2015). Accessed: May 5, 2019.
  37. Joshua Sunshine , Serge Egelman , Hazim Almuhimedi , Neha Atri , and Lorrie Faith Cranor . 2009 . Crying Wolf: An Empirical Study of SSL Warning Effectiveness.. In USENIX security symposium. 399--416. Joshua Sunshine, Serge Egelman, Hazim Almuhimedi, Neha Atri, and Lorrie Faith Cranor. 2009. Crying Wolf: An Empirical Study of SSL Warning Effectiveness.. In USENIX security symposium. 399--416.
  38. Viktoriya Trifonova . 2018. How Device Usage Changed in 2018 and What it Means for 2019 . shorturl.at/gmKV8. (2018). Accessed : May 5, 2019. Viktoriya Trifonova. 2018. How Device Usage Changed in 2018 and What it Means for 2019. shorturl.at/gmKV8. (2018). Accessed: May 5, 2019.
  39. Jordan Valinsky . 2019. Cyber Monday was the biggest shopping day in Amazon's history. shorturl.at/grLNZ. (2019). Last accessed Feb 28, 2020 . Jordan Valinsky. 2019. Cyber Monday was the biggest shopping day in Amazon's history. shorturl.at/grLNZ. (2019). Last accessed Feb 28, 2020.
  40. 10.1145/3025453.3025896 · DOI

Cited by

Sorted by citations

See all 19

Metadata

Authors
Jubur, M., Shrestha, P., Saxena, N., & Prakash, J.
Affiliations
  • University of Alabama at Birmingham (US)
  • Equifax (United States) (US)
  • Singapore University of Technology and Design (SG)
ORCID
Venue
Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security
Publisher
ACM
Published
2021-05-24
Pages
447-461
DOI
10.1145/3433210.3453084
OpenAlex
W3170696348
Cited by
19
References
1
Citations by year
2026: 4 · 2025: 4 · 2024: 4 · 2023: 5 · 2022: 1 · 2021: 1
FWCI
2.28
Type
conference paper
Language
en
Open access
closed
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
ACM Asia Conference on Computer and Communications Security (ASIA CCS) (publishedVersion)
Funders
  • National Science Foundation (CNS-1547350, CNS-1526524 and CNS-1714807)
  • Jazan University
Topics
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
  • Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
Keywords
second-factor authentication, passwordless authentication, push notifications, authentication bypass, mobile authentication

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review