Authentication and Computer Security

互联网认证领域的研究有三个方面的重点：加强用户认证，改进Web服务器和底层浏览器-服务器证书框架的认证，以及探索基于密码访问的威胁。方向包括通过附加信号增强密码身份验证，而无需对用户提出额外要求；通过改进或替换依赖具有预配置的浏览器信任的第三方证书的机制来加强浏览器-服务器身份验证基础设施；以及更好地了解理论攻击和实际攻击之间的差异。目标包括更好地了解当前的弱点，包括可部署性和单点故障，以及在不对用户抱有不切实际的期望的情况下改善完整性的新机制。此外，还探讨了更广泛的问题。

The research in the area of Internet authentication has three-fold focus: strengthening user authentication, improving authentication of web servers and underlying browser-server certificate framework, and exploring threats to password-based access. Directions include enhancing password authentication by additional signals without additional demands on users; strengthening the browser-server authentication infrastructure by improving or replacing mechanisms relying on third-party certificates with pre-configured browser trust; and better understanding differences between theoretical and real-world attacks. Goals include a better understanding of current weaknesses, including deployability and single points of failure, and new mechanisms improving integrity without unrealistic expectations of users. Broader questions are also explored.