| Description | Download | Usability Study | Project Staff |
Problems caused by Phishing and Pharming. Phishing and Pharming, the leading threats to identity theft, result in losses of millions of dollars each year. Many solutions have been proposed to guard against these attacks. Among them, password-based solutions may require additional hardware and are still vulnerable to man-in-the-middle attack; multi-challenge/response based solutions are mostly complicated and may also be susceptible to denial-of-service attacks; and detection-based solutions are ineffective if users dismiss warnings generated by these solutions.
A Novel lightweight Solution. We present a novel lightweightpassword based solution that safeguards users from Phishing and Pharming attacks. The proposed authentication relies on a hashed password, which is the hash value of the user-typed password and the authentication server’s IP address. If a user is unknowingly directed to a malicious server by a phishing or pharming attack, the password obtained by the malicious server will be tied to the malicious server’s IP address and will not be usable by the attacker at the real server, and hence, the phishing/pharming attack will be defeated. The proposed solution does not increase the number of authentication messages exchanged, nor requires addition hardware tokens. The solution is also safe against denial-of-service attacks since no state is maintained on server side during the authentication process. We have prototyped our design both as a web browser’s plug-in and as a standalone application. A comprehensive user study was conducted, and the results show that the design is easy to use and users have shown willingness to use the application to protect their passwords.
Please note: These prototypes are intended for demonstration purposes only. It may also has some security vulnerabilities and programming bugs. As for the plugin, we built it based on PwdHash model developed by Ross et al.. We reused their basic key-hook framework (that means the usages are the same), and replaced the functionality according to our own needs. Details of useage: User Manual.
