论文标题
确保基于Web的应用程序的密码身份验证
Securing Password Authentication for Web-based Applications
论文作者
论文摘要
密码的使用和保护密码的需求不会消失。需要身份验证的大多数网站继续支持密码身份验证。即使是部署2因子身份验证的互联网银行门户等高安全性应用程序，也依靠密码身份验证是身份验证因素之一。但是，尽管在检测和撤离方面进行了积极的努力以及全面的用户意识和培训计划，但网络钓鱼攻击仍继续困扰基于密码的身份验证。 目前，即使是安全意识的网站，也没有万无一失的机制，可以防止用户被定向到欺诈性网站并将其密码放映。在本文中，我们对Web密码登录过程进行威胁分析，并在HTML <inputType =“ password”>字段中发现设计漏洞。可以利用此漏洞来进行网络钓鱼攻击，因为Web身份验证过程未从每个输入密码字段到Web服务器端到端确定。我们确定四个属性，这些属性封装了停止基于Web的密码网络钓鱼的要求，并提出了一个安全协议，以与符合这四个属性的新凭证字段一起使用。我们通过滥用案例评估进一步分析提出的协议，讨论各种部署问题，并执行测试实施以了解其数据和执行开销
The use of passwords and the need to protect passwords are not going away. The majority of websites that require authentication continue to support password authentication. Even high-security applications such as Internet Banking portals, which deploy 2-factor authentication, rely on password authentication as one of the authentication factors. However phishing attacks continue to plague password-based authentication despite aggressive efforts in detection and takedown as well as comprehensive user awareness and training programs. There is currently no foolproof mechanism even for security-conscious websites to prevent users from being directed to fraudulent websites and having their passwords phished. In this paper, we apply a threat analysis on the web password login process, and uncover a design vulnerability in the HTML<inputtype="password"> field. This vulnerability can be exploited for phishing attacks as the web authentication process is not end-to-end secured from each input password field to the web server. We identify four properties that encapsulate the requirements to stop web-based password phishing, and propose a secure protocol to be used with a new credential field that complies with the four properties. We further analyze the proposed protocol through an abuse-case evaluation, discuss various deployment issues, and also perform a test implementation to understand its data and execution overheads
