Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting.

Regarding the paper, there is described the initial "Pairing" between the Pico and an application (thats the action when a user enters the app for the first time). I have a question about that action. If an attacker compromises the users system by wrong DNS records or another technique, so that the users visits a phishing version of the app (for example a website of a bank). Now the user tries to pair with his Pico and the phisher tries to be man-in-the-middle. The keys are now changed between Pico and the phisher and between the phisher and the real website.

Is it correct, that in this situation, an attacker would be able to break into the system? And furthermore, is Pico secure only under the assumption that the key-exchange is not attacked by a man-in-the-middle?

  • $\begingroup$ After a quick look, it looked like agreed keys are authenticated out-of-band via the device screens and displayed information (but I didn't actually read careful enough to make an authoritative answer). $\endgroup$
    – SEJPM
    May 31 '17 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.