Password-based authentication is the dominant form of access control in web services. Unfortunately, it proves to be more and more inadequate every year. Even if users choose long and complex passwords, vulnerabilities in the way they are managed by a service may leak them to an attacker. Recent incidents in popular services such as LinkedIn and Twitter demonstrate the impact that such an event could have. The use of one-way hash functions to mitigate the problem is countered by the evolution of hardware which enables powerful password-cracking platforms.
This research project proposes SAuth, a protocol which employs authentication synergy among different services. Users wishing to access their account on service S will also have to authenticate for their account on service V , which acts as a vouching party. Both services S and V are regular sites visited by the user everyday (e.g., Twitter, Facebook, Gmail). Should an attacker acquire the password for service S he will be unable to log in unless he also compromises the password for service V and possibly more vouching services. SAuth is an extension and not a replacement of existing authentication methods. It operates one layer above them without ties to a specific method, thus enabling different services to employ heterogeneous systems. We complement our design with password decoys to protect users that share a password across services.
People
Georgios Kontaxis (E-Mail: kont...@cs.columbia.edu)
Elias Athanasopoulos (E-Mail: elat...@cs.columbia.edu)
Georgios Portokalidis (E-Mail: gport...@stevens.edu)
Angelos D. Keromytis (E-Mail: ange...@cs.columbia.edu)
Peer-reviewed Publications - Conference Papers
SAuth: Protecting User Accounts from Password Database Leaks. Georgios Kontaxis, Elias Athanasopoulos, Georgios Portokalidis, and Angelos D. Keromytis. In Proceedings of the 20th ACM Conference on Computer and Communications Security (CCS). November 2013, Berlin, Germany. (Acceptance rate: 19.8%) [Slides]
Design Overview
 |
| Overview of synergy-enhanced authentication. A user, with accounts in services S and V (e.g., Twitter and Google), tries to log in S. A standard authentication process takes place which involves the user's password for S (step 1a). Subsequently service S initiates our proposed protocol which involves service V vouching for the user (step 1b). The user is redirected to V with which he also engages a standard authentication process (step 2a) at the end of which service V generates a vouching token for the user to return to S (step 2b). Finally, service S allows the user to access his account if and only if the vouching token from V is verified (step 3a) and optionally returns a persistent authentication token (e.g., cookie) that will bypass this authentication process for subsequent interactions (e.g., HTTP requests) with S. |
Software
Integrating SAuth into an existing web application is simple - Source code and examples coming November 2013
Generating human-like decoy passwords - Toolkit coming November 2013