A zero knowledge password proof mutual authentication technique against real-time phishing attacks

Authors:
Mohsen Sharifi;Alireza Saberi;Mojtaba Vahidi;Mohammad Zorufi
Affiliations:
Computer Engineering Department, Iran University of Science and Technology;Computer Engineering Department, Iran University of Science and Technology;Computer Engineering Department, Iran University of Science and Technology;Computer Engineering Department, Iran University of Science and Technology
Venue:
ICISS'07 Proceedings of the 3rd international conference on Information systems security
Year:
2007

Citing 4
Cited 2

Strong password-only authenticated key exchange

ACM SIGCOMM Computer Communication Review
Protecting Users Against Phishing Attacks with AntiPhish

COMPSAC '05 Proceedings of the 29th Annual International Computer Software and Applications Conference - Volume 01
Why phishing works

Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
Passpet: convenient password management and phishing protection

SOUPS '06 Proceedings of the second symposium on Usable privacy and security

BetterAuth: web authentication revisited

Proceedings of the 28th Annual Computer Security Applications Conference
PhishSafe: leveraging modern JavaScript API's for transparent and robust protection

Proceedings of the 4th ACM conference on Data and application security and privacy

Quantified Score

Hi-index	0.00

Visualization

Abstract

Phishing attack is a kind of identity theft trying to steal confidential data. Existing approaches against phishing attacks cannot prevent real-time phishing attacks. This paper proposes an Anti-Phishing Authentication (APA) technique to detect and prevent real-time phishing attacks. It uses 2-way authentication and zero-knowledge password proof. Users are recommended to customize their user interfaces and thus defend themselves against spoofing. The proposed technique assumes the preexistence of a shared secret key between any two communicating partners, and ignores the existence of any malware at client sides.