TY  - CHAP
U1  - Konferenzveröffentlichung
A1  - Wiefling, Stephan
A1  - Tolsdorf, Jan
A1  - Lo Iacono, Luigi
T1  - Privacy Considerations for Risk-Based Authentication Systems
T2  - 2021 International Workshop on Privacy Engineering (IWPE '21), co-located with 6th IEEE European European Symposium on Security and Privacy (EuroS&P '21). September 7, 2021. Vienna, Austria (Online)
N2  - Risk-based authentication (RBA) extends authentication mechanisms to make them more robust against account takeover attacks, such as those using stolen passwords. RBA is recommended by NIST and NCSC to strengthen password-based authentication, and is already used by major online services. Also, users consider RBA to be more usable than two-factor authentication and just as secure. However, users currently obtain RBA's high security and usability benefits at the cost of exposing potentially sensitive personal data (e.g., IP address or browser information). This conflicts with user privacy and requires to consider user rights regarding the processing of personal data. We outline potential privacy challenges regarding different attacker models and propose improvements to balance privacy in RBA systems. To estimate the properties of the privacy-preserving RBA enhancements in practical environments, we evaluated a subset of them with long-term data from 780 users of a real-world online service. Our results show the potential to increase privacy in RBA solutions. However, it is limited to certain parameters that should guide RBA design to protect privacy. We outline research directions that need to be considered to achieve a widespread adoption of privacy preserving RBA with high user acceptance.
KW  - Risk-based Authentication
KW  - Usable Security and Privacy
KW  - Big Data Analysis
KW  - Password
UN  - https://nbn-resolving.org/urn:nbn:de:hbz:1044-opus-58417
SN  - 2768-0657
SS  - 2768-0657
SN  - 978-1-6654-1012-0
SB  - 978-1-6654-1012-0
U6  - https://doi.org/10.1109/EuroSPW54576.2021.00040
DO  - https://doi.org/10.1109/EuroSPW54576.2021.00040
SP  - 320
EP  - 327
S1  - 8
PB  - IEEE
ER  -