Sound-Proof: Usable Two-Factor Authentication Based on Ambient Sound

(1)

Sound-Proof: Usable Two-Factor Authentication

Based on Ambient Sound

Nikos Karapanos, Claudio Marforio, Claudio Soriente and Srdjan Čapkun

ETH Zurich

(2)

/ 18

Web Authentication

2

(3)

/ 18

Web Authentication

2

• Passwords are used everywhere

• Password reuse, leakage, guessing, phishing… 

(4)

/ 18

Web Authentication

2

• Two-factor authentication to the rescue 

(5)

/ 18

Web Authentication

2

• Two-factor authentication to the rescue 

• Password + Token (one-time code)

• Typically smartphones are used as tokens

(6)

/ 18

Web 2FA Adoption

3

(7)

/ 18

Web 2FA Adoption

3

• Most popular 2FA: Code-based (App or SMS)

• Google, Facebook, Apple, Microsoft, Twitter… 

(8)

/ 18

Web 2FA Adoption

3

• Most popular 2FA: Code-based (App or SMS)

• Google, Facebook, Apple, Microsoft, Twitter… 

• Small user adoption (if 2FA optional)

• Only 25% of Americans use 2FA1

• Only 6% of 100k Gmail accounts have 2FA enabled2

Is 2FA used in practice on the web?

1_{Study by Impermium, 2013 (BusinessWire article,}

http://goo.gl/NsUCL7)

(9)

/ 18

Improving 2FA Usability

4

(10)

/ 18

Improving 2FA Usability

4

Reduce user actions

(11)

/ 18

Improving 2FA Usability

4

• Minimize user-phone interaction

• Just tap a button instead of copying a code

Reduce user actions

(12)

/ 18

Eliminate user-phone interaction

5

(13)

/ 18

Eliminate user-phone interaction

5

• Leverage the proximity between user’s phone and

computer as the second factor

(14)

/ 18

Eliminate user-phone interaction

5

• Proximity can be verified by:

(15)

/ 18

Eliminate user-phone interaction

5

• Using local communication channels  

(phone-computer communication)

How can it be achieved?

(16)

/ 18

Eliminate user-phone interaction

5

• Using local communication channels  

(phone-computer communication)

• Sensing the environment

(17)

/ 18

What are the available options?

6

(18)

/ 18

6

Eliminate user-phone interaction

(19)

/ 18

6

Eliminate user-phone interaction

(PhoneAuth, Czeskis et al., CCS ’12)

Phone-computer communication

(20)

/ 18

6

Eliminate user-phone interaction

(PhoneAuth, Czeskis et al., CCS ’12)

Phone-computer communication

(21)

/ 18

6

Eliminate user-phone interaction

(22)

/ 18

6

Eliminate user-phone interaction

(Shirvanian et al., NDSS ’14)

(23)

/ 18

6

Eliminate user-phone interaction

(24)

/ 18

6

Eliminate user-phone interaction

Phone-computer communication

(25)

/ 18

6

Eliminate user-phone interaction

Phone-computer communication

(26)

/ 18

6

Eliminate user-phone interaction

Phone-computer communication

(27)

/ 18

6

Eliminate user-phone interaction

WebRTC

Phone-computer communication

(28)

/ 18

Contributions

7

(29)

/ 18

Contributions

7

• Novel 2FA mechanism

• Sense ambient audio to verify proximity

(30)

/ 18

Contributions

7

• Sense ambient audio to verify proximity • Usable: No user-phone interaction

(31)

/ 18

Contributions

7

• Deployable: Compatible with smartphones and 

major browsers without plugins

(32)

/ 18

Contributions

7

• Prototype implementation on Android and iOS

(33)

/ 18

Contributions

7

• Prototype implementation on Android and iOS • Evaluation

• Sound-Proof works in a variety of environments, even if the

phone is in a pocket or purse

(34)

/ 18

Sound-Proof

8

(35)

/ 18

Sound-Proof

8

Architecture overview

(36)

/ 18

Sound-Proof

8 Architecture overview Record Record

(37)

/ 18

Sound-Proof

8

(38)

/ 18

Sound-Proof

8

(39)

/ 18

Sound-Proof

8

Architecture overview

(40)

/ 18

Sound-Proof

8 Architecture overview Login authorization (s

⩼

t) Similarity score s

(41)

/ 18

Attacker Model

9

(42)

/ 18

Attacker Model

9 Remote attacker Attacker already knows victim’s credentials

(43)

/ 18

Attacker Model

9 Remote attacker Victim’s username, password Attacker already knows victim’s credentials

(44)

/ 18

Attacker Model

9 Remote attacker Record Record Attacker already knows victim’s credentials

(45)

/ 18

Attacker Model

9 Remote attacker Attacker already knows victim’s credentials

(46)

/ 18

Attacker Model

9 Remote attacker Attacker wins if samples  are similar Attacker already knows victim’s credentials

(47)

/ 18

Attacker Model

9 Remote attacker Attacker wins if samples  are similar Attacker already knows victim’s credentials

Silence can help the attacker. 

Silent samples are rejected

(48)

/ 18

Sound-Proof Evaluation

10

(49)

/ 18

Sound-Proof Evaluation

10

• Total time: User clicks “login” —> browser refresh

to log the user in

• Recording time: 3 seconds 

(50)

/ 18

Sound-Proof Evaluation

10

to log the user in

Performance Total Time (mean) WiFi 4677ms (±181ms) Cellular 4944ms (±233ms) Phone network connectivity

(51)

/ 18

Sound-Proof Evaluation

10

to log the user in

• Room for improvement

• Compress and/or stream browser recording

Performance Total Time (mean) WiFi 4677ms (±181ms) Cellular 4944ms (±233ms) Phone network connectivity

(52)

/ 18

Sound-Proof Evaluation

11

• Environment

• office, office-music, home-TV, lecture

room, train station, café • Laptop

• MacBook Pro Mid 2012, Dell E6510 

(using Google Chrome) • Phone

• iPhone 5, Google Nexus 4

Audio Collection Campaign (2 subjects over 4 weeks)

• Phone position

• outside, in pocket, in purse

• User activity

• being silent, talking, coughing, whistling

(53)

/ 18

Sound-Proof Evaluation

12

(54)

/ 18

Sound-Proof Evaluation

12

• Frequency bands

• ≥ 50Hz (low frequency noise) • ≤ 4kHz (fading, directionality) 

(55)

/ 18

Sound-Proof Evaluation

12

• Frequency bands

Parameter Tuning _{Fraudulent logins not}

detected

Legitimate logins rejected

(56)

/ 18

Sound-Proof Evaluation

12

• Frequency bands

• Similarity score threshold t = 0.13

• Equal Error Rate = 0.002

Parameter Tuning _{Fraudulent logins not}

detected

Legitimate logins rejected

(57)

/ 18

Sound-Proof Evaluation

13

(58)

/ 18

Sound-Proof Evaluation

13 Impact of environment 95th percentile 75th percentile 25th percentile 5th percentile Average Median

(59)

/ 18

Sound-Proof Evaluation

13 Impact of environment 4 false rejections out of 2007

(60)

/ 18

Security Evaluation

14

(61)

/ 18

Security Evaluation

14 Co-located attackers Attacker already knows victim’s credentials

(62)

/ 18

Security Evaluation

14 Co-located attackers Victim’s username, password

(63)

/ 18

Security Evaluation

14 Co-located attackers Record Record

(64)

/ 18

Security Evaluation

14

(65)

/ 18

Security Evaluation

14 Co-located attackers Similar samples! Attack succeeds

(66)

/ 18

Co-located Attacks

15 Hard to defeat Attacker already knows victim’s credentials

(67)

/ 18

Co-located Attacks

15

• Attack trivial if no user-phone interaction

Hard to defeat

Attacker

already knows victim’s credentials

(68)

/ 18

Co-located Attacks

15

• Unless phone-computer pairing is required 

(affects usability)    Hard to defeat Attacker already knows victim’s credentials

(69)

/ 18

Co-located Attacks

15

• Unless phone-computer pairing is required 

(affects usability) 

• Even when 2FA requires user-phone

interaction, a determined, co-located attacker might be hard to defeat...

Hard to defeat

Attacker

already knows victim’s credentials

(70)

/ 18

User Study

16

(71)

/ 18

User Study

16 32 participants (no security experts) in a controlled environment

(72)

/ 18

User Study

Do people find Sound-Proof usable?

(73)

/ 18

User Study

Sound-Proof

(74)

/ 18

User Study

Sound-Proof

Google 2SV

Preferred method

vs

(75)

/ 18

User Study

Sound-Proof

Google 2SV

Preferred method

vs

< 5s > 10s

(76)

/ 18

User Study

Sound-Proof

Google 2SV

Preferred method More likely to opt-in

vs

< 5s > 10s

(77)

/ 18

Attempt to foster 2FA adoption on the web

17

Takeaway

Usability & Deployability

Security Adoption

Sizes are purely qualitative!

(78)

/ 18

17

Takeaway

Security Adoption

Existing 2FA

Password only

(79)

/ 18

17

Takeaway

Usability & Deployability Security Adoption

Sound-Proof

Existing 2FA

Password only

Security Adoption Usability &

Deployability

(80)

Thank you for your attention!

Any Questions?

http://sound-proof.ch/

[email protected]

(81)

/ 18

User Privacy

19

(82)

/ 18

User Privacy

19

• Phone sample never leaves the phone

• Service provider cannot use phone to spy on user

(83)

/ 18

User Privacy

19

• Phone sample never leaves the phone

• Service provider cannot use phone to spy on user

• Browser sample encrypted under phone’s public

key

• Service provider has to actively play Man-In-The-Middle

or supply malicious Javascript

• Can only be abused, while the user is browsing the site

• Browser indicators whenever web site is recording

• Service provider risks detection —> reputation

(84)

/ 18

Audio Comparison

20

(85)

/ 18

Audio Comparison

20

Similarity score computation

(86)

/ 18

Audio Comparison

20

Split signal in 1/3 octave-bands Split signal in 1/3 octave-bands

(87)

/ 18

Audio Comparison

20

Pair-wise cross-correlation  (0 ≤

xcorr

≤ 1)

(88)

/ 18

Audio Comparison

20

Compute average

s

(0 ≤

s

≤ 1), compare with threshold