Countering Concurrent Login Attacks in "Just Tap" Push-Based Authentication: A Redesign and Usability Evaluations

About this work

Abstract

This paper studies the concurrency vulnerability of “Just Tap” push authentication, in which users may approve an attacker-generated notification because it is not explicitly bound to the browser session they initiated. It proposes REPLICATE, a redesign that requires users to reproduce information presented in the browser—such as selecting a shape or performing a directional action—on the authentication device. This interaction creates an explicit link between the browser session and the approval. The paper presents the design and a systematic usability evaluation of multiple REPLICATE variants, finding that participants generally rated them competitively with Just Tap and favorably compared with traditional PIN-based authentication.