Nalazite se na CroRIS probnoj okolini. Ovdje evidentirani podaci neće biti pohranjeni u Informacijskom sustavu znanosti RH. Ako je ovo greška, CroRIS produkcijskoj okolini moguće je pristupi putem poveznice www.croris.hr
izvor podataka: crosbi !

Breaking Undercover: Exploiting Design Flaws and Nonuniform Human Behavior (CROSBI ID 592231)

Prilog sa skupa u zborniku | izvorni znanstveni rad | međunarodna recenzija

Perković, Toni ; Mumtaz, Asma ; Javed, Yousra ; Li, Shujun ; Ali Khayam, Syed ; Čagalj, Mario Breaking Undercover: Exploiting Design Flaws and Nonuniform Human Behavior // Proceedings of the SOUPS '11 (Symposium on Usable Privacy and Security). 2011

Podaci o odgovornosti

Perković, Toni ; Mumtaz, Asma ; Javed, Yousra ; Li, Shujun ; Ali Khayam, Syed ; Čagalj, Mario

engleski

Breaking Undercover: Exploiting Design Flaws and Nonuniform Human Behavior

This paper reports two attacks on Undercover, a human authentication scheme against passive observers proposed at CHI 2008. The first attack exploits nonuniform human behavior in responding to authentication challenges and the second one is based on information leaked from authentication challenges or responses visible to the attacker. The second attack can be generalized to break two alternative Undercover designs presented at Pervasive 2009. All the attacks exploit design flaws of the Undercover implementations. Theoretical and experimental analyses show that both attacks can reveal the user’s password with high probability with O(10) observed login sessions. Both attacks were verified by using the login data collected in a user study with 28 participants. We also propose some enhancements to make Undercover secure against the attacks reported in this paper. Our research in breaking and improving Undercover leads to two broader implications. First, it reemphasizes the principle of "devil is in details" for the design of security-related human- computer interface. Secondly, it reveals a subtle relationship between security and usability: human users may behave in an insecure way to compromise the security of a system. To design a secure human-computer interface, designers should pay special attention to possible negative influence of any detail of the interface including how human users interact with the system.

Passwords; Observation Attack; Undercover; Tactile Device; Audio Channel; Timing Attack; Intersection Attack

nije evidentirano

nije evidentirano

nije evidentirano

nije evidentirano

nije evidentirano

nije evidentirano

Podaci o prilogu

2011.

objavljeno

Podaci o matičnoj publikaciji

Proceedings of the SOUPS '11 (Symposium on Usable Privacy and Security)

Podaci o skupu

The 7th Symposium on Usable Privacy and Security (SOUPS)

predavanje

20.07.2011-22.07.2011

Pittsburgh (PA), Sjedinjene Američke Države

Povezanost rada

Elektrotehnika, Računarstvo