OpenID korean mirror

openid.co.kr을 소유하고 계신 kayflow 님께서 openid.net의 mirror 사이트를 만드시고, openid.co.kr 도메인을 기증하셨네요.

한동안 여기저기 id2.0에 대해서 떠들고 다녔는데, 이렇게 좋은 일을 해주시는 분들이 있으니 조만간 한국에서도 OpenID가 활성화될 것 같습니다.

패스워드 강화 및 피싱관련 논문

이번에 논문쓰면서 참고했던 논문리스트입니다. 참고하시고, 도움이 될만한 다른 논문이 있으면 코멘트로 추가해주세요.

• Phishing Attacks Rising, But Dollar losses Down, Rebecca L. Deuel
• Lightweight Email Signatures, Ben Adida, David Chau, Susan Hohenberger, Ronald L.Rivest
• Separable Identity-Based Ring Signatures: Theoretical Foundations For Fighting Phishing Attacks, Ben Adida, Ronald L.Rivest
• Phish and HIPs: Human Interactive Proofs to Detect Phishing Attacks, Rachna Dhamija, J.D. Tygar
• Modeling and Preventing Phishing Attacks , Markus Jakobsson
• Online Identity Theft: Phishing Technology, Chokepoints and Countermeasures" (ppt), Aaron Emigh
• Anti-Phishing Technology , Aaron Emigh
• Technical Responses to Spam ,Taughannock Networks
• Why Phishing Works , Rachna Dhamija, Marti Hearst
• Accredited DomainKeys: A Service Architecture for Improved Email Validation , Michael T.Goodrich, Roberto Tamassia, Danfeng Yao
• Authentication Using Graphical Passwords: Effects of Tolerance and Image Choice , Susan Wiedenbeck, Jean-camille Birget, Alex Brodskiy
• Attacking Information Visualization System Usability Overloading and Deceiving the Human , Gregory Conti, Mustaque Ahamad, John Stasko
• Social Navigation as a Model for Usable Security , Paul DiGioia and Paul Dourish
• Detection of Phishing Webpages based on visual similarity , Liu Wenyin, Guang Huang, Liu Xiaoyue, Zhang Min, Xiaotie Deng
• Protecting (even) Naive Web Users, or: Preventing Spoofing and Establishing Credentials of Web Sites , Amir Herzberg, Ahmad Gbara
• Visual Spoofing of SSL Protected Web Sites and Effective Countermeasures , Andre Adelsbach, Sebastian Gajek, and J¡§org Schwenk
• User Centric Identity Management , Audun Josang, Simon Pope
• Protecting web users from phishing, spoofing and malware (ppt), Amir Herzberg
• The Battle Against Phishing: Dynamic Security Skins (ppt), Rachna Dhamija, J.D. Tygar
• Do Security Toolbars Actually Prevent Phishing Attacks? , Min Wu, Robert C. Miller, Simson L. Garfinkel
• ViWiD : Visible Watermarking based Defense against Phishing (ppt), Mercan Topkara, Ashish Kamra, Mikhail J. Atallah, Cristina Nita-Rotaru
• Phoolproof Phishing Prevention , Bryan Parno, Cynthia Kuo, Adrian Perrig
• Preventing Web-Spoofing with Automatic Detecting Security Indicator , Fang Qi, Feng Bao, Tieyan Li, Weijia Jia, and Yongdong Wu
• Dejavu: A User Study Using Images for Authentication , Rachna Dhamija, Adrian Perrig
• Hash Visualization: a New Technique to improve Real-World Security , Adrian Perrig, Dawn Song
• Client-side defense against web-based identity theft , Neil Chou, Robert Ledesma, Yuka Teraguchi, Dan Boneh, John C.Mitchell
• WaterkenTM YURL Trust Management for Humans , Waterken YURL
• Web Spoofing Revisited: SSL and Beyond , Eileen Zishuang Ye, Yougu Yuan, Sean Smith
• Trusted Paths for Browsers: An Open-Source Solution to Web Spoofing , Zishuang Ye, Sean Smith
• Trusted Paths for Browsers , Zishuang Ye, Sean Smith, Denise Anthony
• Designing Ethical Phishing Experiments: A study of (ROT13) rOnl query features , Markus Jakobsson, Jacob Ratkiewicz
• Net Trust
• Next Steps toward More Trustworthy Interfaces, Burt Kaliski
• Cache Cookies for Browser Authentication, Ari Juels, Markus Jakobsson, Tom N.Jagatic
• Secure Web Authentication With Mobile Phones (another, another, another), Min Wu, Simson Garfinkel, Robert Miller
• State-transition Model of Trust Management and Access Control, Ajay Chander, Drew Dean, John C.Mitchell
• Hash Visualization, Rachna Dhamija
• Invasive Browser Sniffing and Countermeasures, Markus Jakobsson, Sid Stamm
• Funny Thing Happened on the way to the marketplace, S.W. Smith
• Distributed Phishing Attacks, Markus Jakobsson, Adam Young
• Social Phishing, Tom Jagatic, Nathaniel Johnson, Markus Jakobsson
• PKI seeks a Trusting Relationship, Audun Josang, Ingar Glenn Pedersen
• Thesis Proposal: Fighting Phishing at the User Interface, Min Wu
• Stronger Password Authentication Using Browser Extensions (ppt), Blake Ross, Collin Jackson, Nick Miyake
• Web Spoofing: An Internet Con Game, Edward W.Felten, Dirk Balfanz, Drew Dean
• Dos and Don’ts of Client Authentication on the Web (another), Kevin Fu, Emil Sit, Kendra Smith, Nick Feamster
• Timing Attacks on Web Privacy, Edward W. Felten
• Trust on Web Browser: Attack vs. Defense, Tie-Yan Li, Yongdong Wu
• User Interface Requirements for Authentication of Communication, Audun Josang, Mary Anne Patton
• Security in Mobile Communications: Challenges and Opportunities, Audun Josang, Gunnar Sanderud
• Effective Protection against phishing and Web Spoofing, Rolf Oppliger, Sebastian Gajek
• BaffleText: a Human Interactive Proof, Monica Chew, Henry S.Baird
• Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman, Victor Boyko, Philip Mackenzie, Sarvar Patel
• Security of Web Browser Scripting Languages: Vulnerabilities, Attacks, and Remedies, Vinod Anupam, Alain Mayer
• Authentication for Humans, Audun Josang, Mary Anne Patton, Anthony Ho
• Phishing Activity Trends Report March, 2006, APWG
• Convenient Method for Securely Managing Passwords, J.Alex Halderman, Brent Waters, Edward W.Felten
• Secure Applications of Low-Entropy Keys, John Kelsey, Bruce Schneier, Chris Hall, David Wagner
• Password Security: A case History, Robert Morris, Ken Thompson
• Web Wallet: Preventing Phishing Attacks by Revealing User Intentions, Min Wu, Robert C.Miller, Greg Little
• Framework for Password-based Authenticated Key Exchange, Rosario Gennaro, Yehuda Lindell
• Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords, Jonathan Katz, Rafail ostrovsky, Moti yung
• Design and Analysis of graphical passwords, Ian Jermyn, Alain Mayer, Fabian Monrose, Michael K.Reiter
• How to make Personalized Web Browsing Simple, Secure and Anonymous, Eran Gabber, Phillip B. Gibbons, Yossi Matias, Alain Mayer
• An Antiphishing Strategy Based on Visual Similarity Assessment, Wenyin Liu, Xiaotie Deng, Guanglin Huang, and Anthony Y. Fu
• Strengthening Passwords, Martin Abadi, T.Mark A.Lomas, Roger Needham
• Spyware Resistant Web Authentication Using Virtual Machines, Collin Jackson, Dan Boneh, John C. Mitchell
• A Simple scheme to make passwords based on one-way functions much harder to crack, Udi Manber
• Server-Assisted Generation of a Strong Secret from a Password, Warwick Ford, Kaliski

패스워드 강화방법

이번에 정보처리학회 추계학술발표대회에 논문을 발표하게 되었습니다.
패스워드 강화방법이란 하나의 약한 패스워드로부터 강한 패스워드를 생성하는 방법입니다.

대부분의 사용자들이 여러 웹 사이트에 동일한 패스워드를 사용하는 데, 이러한 점을 악용하여 보안이 낮은 사이트를 공격하여 얻는 패스워드를 다른 사이트를 공격하는 데 사용할 수 있습니다.
이러한 공격을 막기 위한 방법이 패스워드 강화방법(Password Stretching method)입니다.

제가 제안한 방법은 사용자들이 가지고 있는 매체(신용카드, 신분증)의 정보를 이용하여 salting을 하는 방법입니다.

앞으로 브라우저 확장모듈에 붙이고, 영문으로 작성해서 WWW2007에 포스터를 내보려고 합니다.