Abstract:Nowadays, cyberattacks are growing exponentially, causing havoc to Internet users. In particular, authentication attacks constitute the major attack vector where intruders impersonate legitimate users to maliciously access systems or resources. Traditional single-factor authentication (SFA) protocols are often bypassed by side-channel and other attack techniques, hence they are no longer sufficient to the current authentication requirements. To alleviate this problem, multi-factor authentication (MFA) protocols have been widely adopted recently, which helps to raise the security bar against imposters. Although MFA is generally considered more robust and secure than SFA, it may not always guarantee enhanced security and efficiency. This is because, critical security vulnerabilities and performance problems may still arise due to design or implementation flaws of the protocols. Such vulnerabilities are often left unnoticed until they are exploited by attackers. Therefore, the main objective of this work is identifying such vulnerabilities in existing MFA protocols by systematically analysing their designs and constructions. To this end, we first form a set of security evaluation criteria, encompassing both existing and newly introduced ones, which we believe are very critical for the security of MFA protocols. Then, we thoroughly review several MFA protocols across different domains. Subsequently, we revisit and thoroughly analyze the design and construction of the protocols to identify potential vulnerabilities. Consequently, we manage to identify critical vulnerabilities in ten of the MFA protocols investigated. We thoroughly discuss the identified vulnerabilities in each protocol and devise relevant mitigation strategies. We also consolidate the performance information of those protocols to show the runtime and storage cost when employing varying number of authentication factors.

Work in progress: Identifying Two-Factor Authentication Support in Banking Sites

"`They brought in the horrible key ring thing!" Analysing the Usability of Two-Factor Authentication in UK Online Banking

What's in Score for Website Users: A Data-driven Long-term Study on Risk-based Authentication Characteristics

2D-2FA: A New Dimension in Two-Factor Authentication

Simple But Not Secure: An Empirical Security Analysis of Two-factor Authentication Systems

Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild

Dynamic Combination of Authentication Factors Based on Quantified Risk and Benefit

That Depends -- Assessing User Perceptions of Authentication Schemes across Contexts of Use

Excavating Vulnerabilities Lurking in Multi-Factor Authentication Protocols: A Systematic Security Analysis

Combining PIN and Biometric Identifications as Enhancement to User Authentication in Internet Banking

A Systematic Study of the Consistency of Two-Factor Authentication User Journeys on Top-Ranked Websites (Extended Version)

Evaluating User Perception of Multi-Factor Authentication: A Systematic Review

A Passwordless MFA Utlizing Biometrics, Proximity and Contactless Communication

Choosing the right MFA method for online systems: A comparative analysis

Investigation of 3-D Secure's Model for Fraud Detection

A Two-Factor Authentication System with QR Codes for Web and Mobile Applications

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

Four Factor Authentication with emerging cybersecurity for Mobile Transactions

VFA: A Variable-Factor Authentication Framework for Mobile Users.

OTP-Based Two-Factor Authentication Using Mobile Phones

Pump Up Password Security! Evaluating and Enhancing Risk-Based Authentication on a Real-World Large-Scale Online Service