A user study design for comparing the security of registration protocols

Usability, Psychology, and Security, UPSEC 2008

Volumn , Issue , 2008, Pages

  Karlof, Chris ^a   Tygar, J D ^a   Wagner, David ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ECOLOGICAL VALIDITY; MACHINE AUTHENTICATION; USER STUDY;

EID: 67249114599     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (24)

1. Ben Adida. BeamAuth: Two-Factor Web Authentication with a Bookmark. In Proceedings of the Fourteenth ACM Conference on Computer and Communications Security (CCS 07), pages 48-57, October 2007.
2. Dirk Balfanz. Usable Access Control for the World Wide Web. In Proceedings of the 19th Annual Computer Security Applications Conference, pages 406-416, December 2003.
3. Bank of America SiteKey: Online Banking Security. http://www.bankofamerica/privacy/sitekey/.
4. Tyler Close. Waterken YURL. http://www.waterken.com/dev/YURL/httpsy/.
5. Colleen Corley. Students Go'Phishing' for User Info. http://www.idsnews.com/news/story.aspx?id=29400&comview=1.
6. Federal Financial Institutions Examination Council. Authentication in an Internet Banking Environment. http://www.ffiec.gov/pdf/authentication_guidance.pdf, October 2005.
7. Rachna Dhamija, J. D. Tygar, and Marti Hearst. Why Phishing Works. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pages 581-590, 2006.
8. Carl Ellison, Chris Hall, Randy Milbert, and Bruce Schneier. Protecting Secret Keys with Personal Entropy. Future Generation Computer Systems, 16(4):311-318, 2000.
9. Simson Garfinkel. Email-based Identification and Authentication: An Alternative to PKI? IEEE Security & Privacy Magazine, 1(6):20-26, 2003.
10. Peter Gutmann. Underappreciated Security Mechanisms. http://www.cs.auckland.ac.nz/pgut001/pubs/underappreciated. pdf.
11. C. Haney, W.C. Banks, and P.G. Zimbardo. Study of Prisoners and Guards in a Simulated Prison. Naval Research Reviews, 9:1-17, 1973.
12. ING Direct Privacy Center. https://home.ingdirect.com/privacy/privacy_ security.asp?s=newsecurityfeature.
13. Collin Jackson and Adam Barth. ForceHTTPS: Protecting High-Security Web Sites from Network Attacks. In Proceedings of the 17th International World Wide Web Conference (WWW 2008), April 2008.
14. Collin Jackson, Daniel R. Simon, Desney S. Tan, and Adam Barth. An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks. In Proceedings of Usable Security (USEC'07), February 2007.
15. Tom Jagatic, Nathaniel Johnson, Markus Jakobsson, and Filippo Menczer. Social Phishing. Communications of the ACM, 50(10):94-100, October 2007.
16. Markus Jakobsson and Jacob Ratkiewicz. Designing Ethical Phishing Experiments: A Study of (ROT13) rOnl Auction Query Features. In Proceedings of the 15th annual World Wide Web Conference (WWW 2006), pages 513-522, May 2006.
17. Mike Just. Designing Authentication Systems with Challenge Questions. In Lorrie Faith Cranor and Simson Garfinkel, editors, Security and Usability: Designing Secure Systems That People Can Use, chapter 8, pages 143-155. O'Reilly, 2005.
18. Chris Karlof, Umesh Shankar, J.D. Tygar, and David Wagner. Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers. In Fourteenth ACM Conference on Computer and Communications Security (CCS 2007), pages 58-72, October 2007.
19. Stanley Milgram. Obedience to Authority: An Experimental View. Harper Collins, 1974.
20. Stuart Schechter, Rachna Dhamija, Andy Ozment, and Ian Fischer. Emperor's New Security Indicators: An Evaluation of Website Authentication and the Effect of Role Playing on Usability Studies. In Proceedings of the 2007 IEEE Symposium on Security and Privacy, pages 51-65, May 2007.
21. Christopher Soghoian and Markus Jakobsson. A Deceit-Augmented Man in the Middle Attack Against Bank of America's SiteKey Service. http://paranoia.dubfire.net/2007/04/ deceit-augmented-man-in-middle-attack html, April 2007.
22. Vanguard security center. https://www.vanguard.com/.
23. Min Wu, Robert C. Miller, and Simson Garfinkel. Do Security Toolbars Actually Prevent Phishing Attacks? In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pages 601-610, 2006.
24. Jim Youll. Fraud Vulnerabilities in SiteKey Security at Bank of America. cr-labs.com/ publications/SiteKey-20060718.pdf, July 2006.