Enhancing security of the reduced-operation two-factor authentication by using ambient WiFi

Abstract

Recently several reduced-operation two Factor authentication (2FA) methods have been proposed to improve the usability of traditional 2FA. The existing works cannot protect the user’s password from online guessing attack and offline dictionary attack. They cannot resist the identity fraud attack caused by co-located attackers who have obtained the victim’s password. To solve these problems, we provide a WiFi-based 2FA approach which can enhance security of the reduced-operation 2FA but not increase the complexity of the operation for a user. We analyze our approach’s security in terms of identity fraud attack resistance, salt guessing attack resistance, and password guessing attack resistance. We also implement a prototype system and test its performance in various scenarios, e.g. lab, library, and dormitory. The security analysis and experimental results show the effectiveness of our scheme for authentication.