Two-factor authentication: is the world ready?

Abstract

As text-based passwords continue to be the dominant form for user identi cation today, services try to protect their costumers by o ering enhanced, and more secure, technologies for authentication. One of the most promising is two-factor authentication (2FA). 2FA raises the bar for the attacker signi cantly, however, it is still questionable if the technology can be realistically adopted by the majority of Internet users. In this paper, we attempt a rst study for quantifying the adoption of 2FA in probably the largest existing provider, namely Google. For achieving this, we leverage the password-reminder process in a novel way for discovering if 2FA is enabled for a particular account, without annoying or affecting the account's owner. Our technique has many challenges to overcome, since it requires issuing massively thousands of password reminders. In order to remain below the radar, and therefore avoid solving CAPTCHAs or having our hosts blocked, we leverage distributed systems, such as TOR and PlanetLab. After examining over 100,000 Google accounts, we conclude that 2FA has not yet been adopted by more than 6.4% of the users. Last but not least, as a side-e ect of our technique, we are also able to ex ltrate private information, which can be potentially used for malicious purposes. Thus, in this paper we additionally present important ndings for raising concerns about privacy risks in designing password reminders.

Even Turing Should Sometimes Not Be Able to Tell: Mimicking Humanoid Usage Behavior for Exploratory Studies of Online Services

“…Other browser automation frameworks tried to imitate human-like useractions to a small extent. Petsas et al [29] used browser automation to evaluate the quantity of Google users with enabled Two-factor Authentication (2FA). Their framework introduced a random waiting time between clicks.…”

“…Most browser automation tools described in this section were based on the Selenium framework [15,17,12,32,19,10,34]. One tool was based on CasparJS [29]. We decided to use the high-level application programming library Puppeteer [21] as a base for our tool.…”

“…Further, when using HOSIT, researchers should carefully check not to violate the respective Terms of Service. Also, researchers should use automated browsing responsibly, e.g., by keeping the impact on the inspected online services minimal [29,45].…”

ICT Systems Security and Privacy Protection

“…Petsas et al [22] estimated the quantity of Google user accounts with enabled 2FA functionality. They used headless browser automation with enhancements for user simulation.…”

“…To increase the users' security, service operators should implement additional measures. Two-factor authentication (2FA) [22] is one widely offered measure that improves account security, but is rather unpopular (e.g. in January 2018, less than 10 % of active Google accounts used 2FA [19]).…”