Abstract:The two-factor authentication ($2$FA) has drawn increasingly attention as the mobile devices become more prevalent. For example, the user's possession of the enrolled phone could be used by the $2$FA system as the second proof to protect his/her online accounts. Existing $2$FA solutions mainly require some form of user-device interaction, which may severely affect user experience and creates extra burdens to users. In this work, we propose a secure $2$FA system utilizing the proximity of a user's enrolled phone and the login device as the second proof without requiring the user's interactions. The basic idea of our $2$FA system is to derive location signatures based on acoustic beep signals emitted alternately by both devices and sensing the echoes with microphones, and compare the extracted signatures for proximity detection. Moreover, to further enhance the security of our system, we also design a device authentication scheme which derives the acoustic fingerprint between the login device and enrolled phone to verify the identity of two devices. Given the received beep signal, our system designs a period selection scheme to identify two sound segments accurately: the chirp period is the sound segment propagating directly from the speaker to the microphone whereas the echo period is the sound segment reflected back by surrounding objects. To achieve an accurate proximity detection, we develop a new energy loss compensation extraction scheme by utilizing the extracted chirp periods to estimate the intrinsic differences of energy loss between microphones of the enrolled phone and the login device. Our proximity detection component then conducts the similarity comparison between the identified two echo periods after the energy loss compensation to effectively determine whether the enrolled phone and the login device are in proximity for $2$FA. Moreover, to provide higher security, our device fingerprint-assisted proximity detection further utilizes the overall energy loss between the login device and enrolled phone as their hardware fingerprint to authenticate the identity of two devices. Our experimental results show that our system is accurate in providing $2$FA and robust to both man-in-the-middle (MiM) and co-located attacks across different scenarios and device models.

Social Engineering Resistant 2FA

True2F: Backdoor-resistant authentication tokens

2D-2FA: A New Dimension in Two-Factor Authentication

Simple But Not Secure: An Empirical Security Analysis of Two-factor Authentication Systems

Counteracting Social Engineering Attacks

Reducing Usefulness of Stolen Credentials in SSO Contexts

A Passwordless MFA Utlizing Biometrics, Proximity and Contactless Communication

Let Your Camera See for You: A Novel Two-Factor Authentication Method against Real-Time Phishing Attacks

Leveraging Machine Learning for Wi-Fi-based Environmental Continuous Two-Factor Authentication

SoundID: Securing Mobile Two-Factor Authentication Via Acoustic Signals

"`They brought in the horrible key ring thing!" Analysing the Usability of Two-Factor Authentication in UK Online Banking

On the Usability of Two-Factor Authentication.

A Blockchain-Based Authentication Mechanism for Enhanced Security

Securing Remote Access to Information Systems of Critical Infrastructure Using Two-Factor Authentication

0EISUA: Zero Effort Indoor Secure User Authentication

Strategies for Counteracting Social Engineering Attacks

Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them

A novel Two-Factor HoneyToken Authentication Mechanism

Secure Mobile Two-Factor Authentication Leveraging Active Sound Sensing

Internet-based Social Engineering Attacks, Defenses and Psychology: A Survey