Phish in sheep's clothing: Exploring the authentication pitfalls of browser fingerprinting

X Lin, P Ilia, S Solanki, J Polakis - 31st USENIX Security Symposium …, 2022 - usenix.org
As users navigate the web they face a multitude of threats; among them, attacks that result in
account compromise can be particularly devastating. In a world fraught with data breaches …

Evaluating the security posture of real-world fido2 deployments

D Kuchhal, M Saad, A Oest, F Li - … of the 2023 ACM SIGSAC Conference …, 2023 - dl.acm.org
FIDO2 is a suite of protocols that combines the usability of local authentication (eg,
biometrics) with the security of public-key cryptography to deliver passwordless …

Pump up password security! Evaluating and enhancing risk-based authentication on a real-world large-scale online service

S Wiefling, PR Jørgensen, S Thunem… - ACM Transactions on …, 2022 - dl.acm.org
Risk-based authentication (RBA) aims to protect users against attacks involving stolen
passwords. RBA monitors features during login, and requests re-authentication when …

A {Two-Decade} Retrospective Analysis of a University's Vulnerability to Attacks Exploiting Reused Passwords

A Nisenoff, M Golla, M Wei, J Hainline… - 32nd USENIX Security …, 2023 - usenix.org
Credential-guessing attacks often exploit passwords that were reused across a user's online
accounts. To learn how organizations can better protect users, we retrospectively analyzed …

Evaluation of account recovery strategies with fido2-based passwordless authentication

J Kunke, S Wiefling, M Ullmann, LL Iacono - arxiv preprint arxiv …, 2021 - arxiv.org
Threats to passwords are still very relevant due to attacks like phishing or credential stuffing.
One way to solve this problem is to remove passwords completely. User studies on …

A study of {Multi-Factor} and {Risk-Based} authentication availability

A Gavazzi, R Williams, E Kirda, L Lu, A King… - 32nd USENIX Security …, 2023 - usenix.org
Password-based authentication (PBA) remains the most popular form of user authentication
on the web despite its long-understood insecurity. Given the deficiencies of PBA, many …

Account security interfaces: important, unintuitive, and untrustworthy

A Daffalla, M Bohuk, N Dell, R Bellini… - 32nd USENIX Security …, 2023 - usenix.org
Online services increasingly rely on user-facing interfaces to communicate important
security-related account information—for example, which devices are logged into a user's …

Verify it's you: how users perceive risk-based authentication

S Wiefling, M Dürmuth, LL Iacono - IEEE Security & Privacy, 2021 - ieeexplore.ieee.org
Risk-based authentication (RBA) is an adaptive security measure used to strengthen
password-based authentication against account takeover attacks. Our study on 65 …

A framework for analyzing authentication risks in account networks

D Pöhn, N Gruschka, L Ziegler, A Büttner - Computers & Security, 2023 - Elsevier
Our everyday life depends more and more on online services and, therefore, access to
related user accounts. The security of user accounts, again, is tied to the security of the …