NDLI: PhorceField: a phish-proof password ceremony

Please wait, while we are loading the content...

Understanding the prevalence and use of alternative plans in malware with network games

Distilling critical attack graph surface iteratively through minimum-cost SAT solving

"Mix-in-Place" anonymous networking using secure function evaluation

The socialbot network: when bots socialize for fame and money

A peel of onion

The science of cyber security experimentation: the DETER project

Facing the facts about image type in recognition-based graphical passwords

Improving robustness of DNS to software vulnerabilities

Exploring the potential benefits of expanded rate limiting in Tor: slow and steady wins the race with Tortoise

SEMAGE: a new image-based two-factor CAPTCHA

ASIDE: IDE support for web application security

An empirical study of visual security cues to prevent the SSLstripping attack

Key escrow from a safe distance: looking back at the Clipper Chip

Reliable telemetry in white spaces using remote attestation

Mitigating code-reuse attacks with control-flow locking

Nexat: a history-based approach to predict attacker actions

BareBox: efficient malware analysis on bare-metal

FORECAST: skimming off the malware cream

RIPE: runtime intrusion prevention evaluator

Security through amnesia: a software-based solution to the cold boot attack on disk encryption

Detecting and resolving privacy conflicts for collaborative data sharing in online social networks

PhorceField: a phish-proof password ceremony

Enabling secure VM-vTPM migration in private clouds

"Super nodes" in Tor: existence and security implication

BLOCK: a black-box approach for detection of state violation attacks towards web applications

Tracking payment card data flow using virtual machine state introspection

AdSentry: comprehensive and flexible confinement of JavaScript-based advertisements

Don't Bump, Shake on It: the exploitation of a popular accelerometer-based smart phone exchange and its secure replacement

deRop: removing return-oriented programming from malware

From prey to hunter: transforming legacy embedded devices into exploitation sensor grids

Automated remote repair for mobile malware

Detecting malware's failover C&C strategies with squeeze

Hit 'em where it hurts: a live security exercise on cyber situational awareness

Private search in the real world

Social snapshots: digital forensics for online social networks

Dynamic sample size detection in continuous authentication using sequential sampling

Exposing invisible timing-based traffic watermarks with BACKLIT

Smart metering de-pseudonymization

A server- and browser-transparent CSRF defense for web 2.0 applications

WebJail: least-privilege integration of third-party components in web mashups

Attacks on WebView in the Android system

Static detection of malicious JavaScript-bearing PDF documents

PhorceField: a phish-proof password ceremony

Content Provider	ACM Digital Library
Author	Harpalani, Manoj Hart, Michael Toohill, Jonathan Castille, Claude Johnson, Rob
Abstract	Many widely deployed phishing defense schemes, such as SiteKey, use client-side secrets to help users confirm that they are visiting the correct website before entering their passwords. Unfortunately, studies have demonstrated that up to 92% of users can be convinced to ignore missing client-side secrets and enter their passwords into phishing pages. However, since client-side secrets have already achieved industry acceptance, they are an attractive building block for creating better phishing defenses. We present PhorceField, a phishing resistant password ceremony that combines client-side secrets and graphical passwords in a novel way that provides phishing resistance that neither achieves on its own. PhorceField enables users to login easily, but forces phishers to present victims with a fundamentally unfamiliar and onerous user interface. Victims that try to use the phisher's interface to enter their password find the task so difficult that they give up without revealing their password. We have evaluated PhorceField's phishing resistance in a user study in which 21 participants used PhorceField for a week and were then subjected to a simulated phishing attack. On average, participants were only able to reveal 20% of the entropy in their password, and none of them revealed their entire password. This is a substantial improvement over previous research that demonstrated that 92% of users would reveal their entire password to a phisher, even if important security indicators were missing[27]. PhorceField is easy to deploy in sites that already use client-side secrets for phishing defense -- it requires no client-side software and can be implemented entirely in javascript. Banks and other high value websites could therefore deploy it as a drop-in replacement for existing defenses, or deploy it on an "opt-in" basis, as Google has done with its phone-based "2-step verification" system.
Starting Page	159
Ending Page	168
Page Count	10
File Format	PDF
ISBN	9781450306720
DOI	10.1145/2076732.2076755
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2011-12-05
Publisher Place	New York
Access Restriction	Subscribed
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in