2020/11/12 by Teik Guan Tan, Tan, Teik Guan, Paweł Szałachowski +4
Computer Science · Social Sciences · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Networking and Internet Architecture (cs.NI) #Privacy, Security, and Data Protection #Spam and Phishing Detection #User Authentication and Security Systems #cs.CR #cs.NI
paper · pdf · doi:10.48550/arxiv.2011.06257
23 pages, 1 figure
arxiv created 2020/11/12 · openalex publication_date 2020/11/12 · arxiv updated 2020/11/13 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
The use of passwords and the need to protect passwords are not going away. The majority of websites that require authentication continue to support password authentication. Even high-security applications such as Internet Banking portals, which deploy 2-factor authentication, rely on password authentication as one of the authentication factors. However phishing attacks continue to plague password-based authentication despite aggressive efforts in detection and takedown as well as comprehensive user awareness and training programs. There is currently no foolproof mechanism even for security-conscious websites to prevent users from being directed to fraudulent websites and having their passwords phished. In this paper, we apply a threat analysis on the web password login process, and uncover a design vulnerability in the HTML<inputtype="password"> field. This vulnerability can be exploited for phishing attacks as the web authentication process is not end-to-end secured from each input password field to the web server. We identify four properties that encapsulate the requirements to stop web-based password phishing, and propose a secure protocol to be used with a new credential field that complies with the four properties. We further analyze the proposed protocol through an abuse-case evaluation, discuss various deployment issues, and also perform a test implementation to understand its data and execution overheads