Back Channels Can Be Useful! – Layering Authentication Channels to Provide Covert Communication (Transcript of Discussion)

Abstract

Robert Watson: Can you just clarify the problem very slightly. Is the goal to make users use some passwords less frequently or you want them to have the ability to delegate?

Reply: Delegation is part of what we want to achieve. However, the main goal is to give users a ways to express their intentions and doubts through the password protocol itself. This will give them different levels of access. Why would users want to do that? Take as an example the case where users get an email to take some actions. The user might think that the real service provider might have solicited them, but when they convey this information to the server, in the case the server didn’t solicit them, phishing attempt can be detected before any damage could happen. The main challenge of course is how users can convey this message in a way that is undetected by middle parties.