Delayed password disclosure. (7th February 2008)

• Record Type: Journal Article
• Authors: Jakobsson, Markus; Myers, Steven
• Is Part Of: International journal of applied cryptography. Volume 1:Number 1(2008)
• Page Start: 47
• Page End: 59
• Publication Date: 2008-02-07
• Subjects: decisional Diffie-Hellman -- static Diffie-Hellman -- doppelganger -- oblivious transfer -- password authenticated key exchange -- PAKE -- phishing -- secure user interfaces -- delayed password disclosure -- authentication protocols -- spoofing attacks -- applied cryptography -- security degradation; Data encryption (Computer science) -- Periodicals; Cryptography -- Periodicals; Computer security -- Periodicals; 652.8
• Languages: English
• ISSNs: 1753-0563

Abstract

We present a new authentication protocol called Delayed Password Disclosure (DPD). Based on the traditional username and password paradigm, the protocol's goal is aimed at reducing the effectiveness of phishing/spoofing attacks that are becoming increasingly problematic for Internet users. This is done by providing the user with dynamic feedback while password entry occurs. While this is a process that would normally be frowned upon by the cryptographic community, we argue that it may result in more effective security than that offered by currently proposed 'cryptographically acceptable' alternatives. While the protocol cannot prevent partial disclosure of one's password to the phisher, it does provide a user with the tools necessary to recognise an ongoing phishing attack, and prevent the disclosure of his/her entire password, providing graceful security degradation.