Enhancing the Security of On-line Transactions with CAPTCHA Keyboard

Abstract : In an on-line transaction, a client usually have to present some authenticators (password, user certificate or both) to the server. However, those authenticators are exposed to client-side malware such that the malware is able to obtain the server-client messages, or impersonate the user to build another “secure” channel with the server.The present paper aims to patch this client-side security flaw with a novel password-input method. Specifically, it enables a user to input a password by clicking an on-screen CAPTCHA keyboard, rather than a keyboard typing. The CAPTCHA keyboard is designed to greatly increase the difficulty of password eavesdropping and phishing in a malicious environment given that the malware can not monitor the browser secret memory space. Our implementation shows that Firwfox browser incorporated with CAPTCHA Keyboard and smartcard is viable and transparent over HTTPS protocol.
Document type :
Conference papers
Complete list of metadatas

Cited literature [5 references]  Display  Hide  Download

https://hal.inria.fr/hal-01518212
Contributor : Hal Ifip <>
Submitted on : Thursday, May 4, 2017 - 1:45:13 PM
Last modification on : Thursday, May 4, 2017 - 2:53:56 PM
Long-term archiving on : Saturday, August 5, 2017 - 1:02:02 PM

File

978-3-642-30436-1_44_Chapter.p...
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Yongdong Wu, Zhigang Zhao. Enhancing the Security of On-line Transactions with CAPTCHA Keyboard. 27th Information Security and Privacy Conference (SEC), Jun 2012, Heraklion, Crete, Greece. pp.531-536, ⟨10.1007/978-3-642-30436-1_44⟩. ⟨hal-01518212⟩

Share

Metrics

Record views

62

Files downloads

113