Can Unicorns Help Users Compare Crypto Key Fingerprints?
Can Unicorns Help Users Compare Crypto Key Fingerprints?
复制标题
独角兽可以帮助用户比较加密密钥指纹吗？
DOI：
10.1145/3025453.3025733
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Blase Ur
中科院分区：
文献类型：
--
作者：
Joshua Tan;Lujo Bauer;Joseph Bonneau;L. Cranor;Jeremy Thomas;Blase Ur
许多身份验证方案要求用户手动比较加密密钥的紧凑表示形式，即指纹。如果指纹不匹配，则可能标志着中间人的攻击。执行攻击的对手可能会使用类似于目标指纹但不是确切匹配的指纹，以尝试欺骗不专心的用户。因此，指纹表示应该是可用的和安全的。我们在不同配置下测试了八个指纹表示的可用性和安全性。在一个受试者之间的661个参与者实验中，参与者在现实条件下比较了指纹，并受到了模拟攻击。最佳配置允许攻击能够有6％的时间成功；最差的72％。我们发现，看似有效的比较方法对于关键指纹和图形指纹表示的表现效果较差，而直观且快速的性能各不相同。我们将一些指纹表示形式确定为特别有希望的。
Many authentication schemes ask users to manually compare compact representations of cryptographic keys, known as fingerprints. If the fingerprints do not match, that may signal a man-in-the-middle attack. An adversary performing an attack may use a fingerprint that is similar to the target fingerprint, but not an exact match, to try to fool inattentive users. Fingerprint representations should thus be both usable and secure. We tested the usability and security of eight fingerprint representations under different configurations. In a 661-participant between-subjects experiment, participants compared fingerprints under realistic conditions and were subjected to a simulated attack. The best configuration allowed attacks to succeed 6% of the time; the worst 72%. We find the seemingly effective compare-and-select approach performs poorly for key fingerprints and that graphical fingerprint representations, while intuitive and fast, vary in performance. We identify some fingerprint representations as particularly promising.