Strengthening Password-Based Web Authentication Through Multiple Supplementary Mechanisms
Bibliographic record
Abstract
User authentication is one of the primary mechanisms that protects online accounts from break-in by attackers.Password-based authentication is currently the most widespread form of user authentication, but has many well-documented usability and security drawbacks.As an increasing number of consumer, financial, governmental, and other organizations move towards offering services online, users are burdened with creating and managing increasingly large portfolios of online accounts; this increased user burden exacerbates the drawbacks of password-based authentication.This thesis contributes to the reinforcement of password-based authentication by pursuing parallel mechanisms that improve security without further burdening users-this is a prominent avenue of improvement, given the continued dominance of password authentication.To that end, our contributions achieve three broad goals.First, we identify, develop, and evaluate device fingerprinting mechanisms for use alongside passwords, and offer guidance on their use, to enhance the security of password-based web authentication.Second, we expand on the concept of mimicry resistance, a dimension that has thus far been overlooked in the design and study of web authentication schemes.We develop a comprehensive methodology for evaluating the mimicry resistance of web authentication schemes and provide guidance on how to combine multiple schemes alongside password authentication to maximize the benefits gained.Third, we perform a comprehensive analysis and evaluation of a broad range of single sign-on (SSO) schemes, which reduce password fatigue by allowing users to access a multitude of online services through a single master password.We identify design properties of SSO schemes and develop an evaluation framework that highlights their benefits and drawbacks, revealing trade-offs between different designs.These three contributions encompass complementary approaches that can be used together to improve online security with minimal impact on usability.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.009 | 0.032 |
| Meta-epidemiology (narrow) | 0.001 | 0.001 |
| Meta-epidemiology (broad) | 0.001 | 0.001 |
| Bibliometrics | 0.002 | 0.001 |
| Science and technology studies | 0.001 | 0.002 |
| Scholarly communication | 0.004 | 0.012 |
| Open science | 0.003 | 0.006 |
| Research integrity | 0.002 | 0.003 |
| Insufficient payload (model declined to judge) | 0.007 | 0.003 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".