Comparative Analysis and Framework Evaluating Mimicry-Resistant and\n Invisible Web Authentication Schemes

Many password alternatives for web authentication proposed over the years,\ndespite having different designs and objectives, all predominantly rely on the\nknowledge of some secret. This motivates us, herein, to provide the first\ndetailed exploration of the integration of a fundamentally different element of\ndefense into the design of web authentication schemes: a mimicry-resistance\ndimension. We analyze web authentication mechanisms with respect to new\nusability and security properties related to mimicry-resistance (augmenting the\nUDS framework), and in particular evaluate invisible techniques (those\nrequiring neither user actions, nor awareness) that provide some\nmimicry-resistance (unlike those relying solely on static secrets), including\ndevice fingerprinting schemes, PUFs (physically unclonable functions), and a\nsubset of Internet geolocation mechanisms.\n