arXiv:0911.5230cs.CR
PAKE-based mutual HTTP authentication for preventing phishing attacks
Early discovery. Linked by one identifiable commenter. This paper is outside the main ranking; a mention is not an endorsement.
Abstract
This paper describes a new password-based mutual authentication protocol for Web systems which prevents various kinds of phishing attacks. This protocol provides a protection of user's passwords against any phishers even if dictionary attack is employed, and prevents phishers from imitating a false sense of successful authentication to users. The protocol is designed considering interoperability with many recent Web applications which requires many features which current HTTP authentication does not provide. The protocol is proposed as an Internet Draft submitted to IETF, and implemented in both server side (as an Apache extension) and client side (as a Mozilla-based browser and an IE-based one). The paper also proposes a new user-interface for this protocol which is always distinguishable from fake dialogs provided by phishers.
I wish TLS-SRP was more prominent or that some mutual auth protocol was common (http://arxiv.org/abs/0911.5230). Then you're never sending anything sensitive to the server. Sure, it still has the issue of the user choosing a good password, but persona doesn't really get around…
jimktrains2View on HNParent context