{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,12]],"date-time":"2024-09-12T20:10:35Z","timestamp":1726171835573},"publisher-location":"Cham","reference-count":34,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783031157769"},{"type":"electronic","value":"9783031157776"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-15777-6_11","type":"book-chapter","created":{"date-parts":[[2022,8,23]],"date-time":"2022-08-23T15:24:33Z","timestamp":1661268273000},"page":"184-200","update-policy":"http:\/\/dx.doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Exploring Phone-Based Authentication Vulnerabilities in\u00a0Single Sign-On Systems"],"prefix":"10.1007","author":[{"given":"Matthew M.","family":"Tolbert","sequence":"first","affiliation":[]},{"given":"Elie M.","family":"Hess","sequence":"additional","affiliation":[]},{"given":"Mattheus C.","family":"Nascimento","sequence":"additional","affiliation":[]},{"given":"Yunsen","family":"Lei","sequence":"additional","affiliation":[]},{"given":"Craig A.","family":"Shue","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,8,24]]},"reference":[{"key":"11_CR1","unstructured":"Akhawe, D., Felt, A.P.: Alice in warningland: a large-scale field study of browser security warning effectiveness. In: USENIX Security Symposium, pp. 257\u2013272 (2013)"},{"issue":"4","key":"11_CR2","first-page":"192","volume":"27","author":"A Amran","year":"2018","unstructured":"Amran, A., Zaaba, Z.F., Mahinderjit Singh, M.K.: Habituation effects in computer security warning. Inf. Secur. J.: Global Perspect. 27(4), 192\u2013204 (2018)","journal-title":"Inf. Secur. J.: Global Perspect."},{"key":"11_CR3","doi-asserted-by":"publisher","unstructured":"Anderson, B.B., Kirwan, C.B., Jenkins, J.L., Eargle, D., Howard, S., Vance, A.: How polymorphic warnings reduce habituation in the brain: insights from an FMRI study. In: ACM Conference on Human Factors in Computing Systems, pp. 2883\u20132892 (2015). https:\/\/doi.org\/10.1145\/2702123.2702322","DOI":"10.1145\/2702123.2702322"},{"key":"11_CR4","unstructured":"Avatier: Azure active directory seamless single sign-on (2020). https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/hybrid\/how-to-connect-sso. Accessed 29 Apr 2021"},{"key":"11_CR5","unstructured":"Avatier: Which companies use multi-factor authentication with their customers? (2021). https:\/\/www.avatier.com\/blog\/companies-use-multi-factor-authentication-customers\/. Accessed 29 Apr 2021"},{"key":"11_CR6","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1007\/978-3-642-23768-3_2","volume-title":"Human-Computer Interaction \u2013 INTERACT 2011","author":"C Bravo-Lillo","year":"2011","unstructured":"Bravo-Lillo, C., Cranor, L.F., Downs, J., Komanduri, S., Sleeper, M.: Improving computer security dialogs. In: Campos, P., Graham, N., Jorge, J., Nunes, N., Palanque, P., Winckler, M. (eds.) INTERACT 2011. LNCS, vol. 6949, pp. 18\u201335. Springer, Heidelberg (2011). https:\/\/doi.org\/10.1007\/978-3-642-23768-3_2"},{"key":"11_CR7","unstructured":"Bre\u0144ski, K.P.: Evil Hotspot-are public hotspots safe? Ph.D. thesis, Zak\u0142ad Strukturalnych Metod Przetwarzania Wiedzy (2017)"},{"key":"11_CR8","doi-asserted-by":"publisher","unstructured":"Brustoloni, J.C., Villamar\u00edn-Salom\u00f3n, R.: Improving security decisions with polymorphic and audited dialogs. In: Proceedings of the ACM Symposium on Usable Privacy and Security, pp. 76\u201385 (2007). https:\/\/doi.org\/10.1145\/1280680.1280691","DOI":"10.1145\/1280680.1280691"},{"key":"11_CR9","unstructured":"Cristofaro, E.D., Du, H., Freudiger, J., Norcie, G.: Two-factor or not two-factor? A comparative usability study of two-factor authentication. CoRR abs\/1309.5344 (2013). http:\/\/arxiv.org\/abs\/1309.5344"},{"key":"11_CR10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"160","DOI":"10.1007\/978-3-662-58387-6_9","volume-title":"Financial Cryptography and Data Security","author":"S Das","year":"2018","unstructured":"Das, S., Dingman, A., Camp, L.J.: Why Johnny doesn\u2019t use two factor a two-phase usability study of the FIDO U2F security key. In: Meiklejohn, S., Sako, K. (eds.) FC 2018. LNCS, vol. 10957, pp. 160\u2013179. Springer, Heidelberg (2018). https:\/\/doi.org\/10.1007\/978-3-662-58387-6_9"},{"key":"11_CR11","unstructured":"Das, S., Wang, B., Tingle, Z., Camp, L.J.: Evaluating user perception of multi-factor authentication: a systematic review. CoRR abs\/1908.05901 (2019). http:\/\/arxiv.org\/abs\/1908.05901"},{"key":"11_CR12","series-title":"Infosys Science Foundation Series","doi-asserted-by":"publisher","first-page":"185","DOI":"10.1007\/978-3-319-58808-7_5","volume-title":"Advances in User Authentication","author":"D Dasgupta","year":"2017","unstructured":"Dasgupta, D., Roy, A., Nag, A.: Multi-factor authentication. In: Advances in User Authentication. ISFS, pp. 185\u2013233. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-58808-7_5"},{"key":"11_CR13","doi-asserted-by":"publisher","unstructured":"Dhamija, R., Tygar, J.D., Hearst, M.: Why phishing works. In: Proceedings of the ACM SIGCHI Conference on Human Factors in Computing Systems, pp. 581\u2013590 (2006). https:\/\/doi.org\/10.1145\/1124772.1124861","DOI":"10.1145\/1124772.1124861"},{"key":"11_CR14","doi-asserted-by":"publisher","unstructured":"Doerfler, P., et al.: Evaluating login challenges as a defense against account takeover. In: The ACM World Wide Web Conference, pp. 372\u2013382 (2019). https:\/\/doi.org\/10.1145\/3308558.3313481","DOI":"10.1145\/3308558.3313481"},{"key":"11_CR15","doi-asserted-by":"publisher","unstructured":"Downs, J.S., Holbrook, M.B., Cranor, L.F.: Decision strategies and susceptibility to phishing. In: Proceedings of the ACM Symposium on Usable Privacy and Security, pp. 79\u201390 (2006). https:\/\/doi.org\/10.1145\/1143120.1143131","DOI":"10.1145\/1143120.1143131"},{"key":"11_CR16","unstructured":"European Commission: Payment services (PSD 2) - directive (EU) 2015\/2366 (2015). https:\/\/ec.europa.eu\/info\/law\/payment-services-psd-2-directive-eu-2015-2366_en. Accessed 6 June 2022"},{"key":"11_CR17","doi-asserted-by":"publisher","unstructured":"Felt, A.P., et al.: Improving SSL warnings: comprehension and adherence. In: Proceedings of the ACM Conference on Human Factors in Computing Systems, pp. 2893\u20132902 (2015). https:\/\/doi.org\/10.1145\/2702123.2702442","DOI":"10.1145\/2702123.2702442"},{"key":"11_CR18","unstructured":"Government of Singapore: Police advisory on scam survey leading to the misuse of singpass access to digital services (2022). https:\/\/ec.europa.eu\/info\/law\/payment-services-psd-2-directive-eu-2015-2366_en. Accessed 6 June 2022"},{"issue":"1","key":"11_CR19","doi-asserted-by":"publisher","first-page":"74","DOI":"10.1145\/2063176.2063197","volume":"55","author":"J Hong","year":"2012","unstructured":"Hong, J.: The state of phishing attacks. Commun. ACM 55(1), 74\u201381 (2012). https:\/\/doi.org\/10.1145\/2063176.2063197","journal-title":"Commun. ACM"},{"issue":"4","key":"11_CR20","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1145\/3424302.3425909","volume":"18","author":"RP Jover","year":"2020","unstructured":"Jover, R.P.: Security analysis of SMS as a second factor of authentication: the challenges of multifactor authentication based on SMS, including cellular security deficiencies, SS7 exploits, and sim swapping. Queue 18(4), 37\u201360 (2020)","journal-title":"Queue"},{"key":"11_CR21","unstructured":"Kerkhoff Technologies Inc: Netfilterqueue (2021). https:\/\/github.com\/kti\/python-netfilterqueue. Accessed 29 Apr 2021"},{"key":"11_CR22","doi-asserted-by":"publisher","unstructured":"Kondracki, B., Azad, B.A., Starov, O., Nikiforakis, N.: Catching transparent phish: analyzing and detecting MITM phishing toolkits. In: Proceedings of the ACM Conference on Computer and Communications Security, pp. 36\u201350 (2021). https:\/\/doi.org\/10.1145\/3460120.3484765","DOI":"10.1145\/3460120.3484765"},{"key":"11_CR23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"405","DOI":"10.1007\/978-3-662-54970-4_24","volume-title":"Financial Cryptography and Data Security","author":"RK Konoth","year":"2017","unstructured":"Konoth, R.K., van der Veen, V., Bos, H.: How anywhere computing just killed your phone-based two-factor authentication. In: Grossklags, J., Preneel, B. (eds.) FC 2016. LNCS, vol. 9603, pp. 405\u2013421. Springer, Heidelberg (2017). https:\/\/doi.org\/10.1007\/978-3-662-54970-4_24"},{"key":"11_CR24","unstructured":"Lee, K., Kaiser, B., Mayer, J., Narayanan, A.: An empirical study of wireless carrier authentication for SIM swaps. In: Symposium on Usable Privacy and Security, pp. 61\u201379 (2020)"},{"key":"11_CR25","doi-asserted-by":"crossref","unstructured":"Microsoft: Microsoft digital defense report (2020). https:\/\/www.microsoft.com\/en-us\/security\/business\/security-intelligence-report. Accessed 29 Apr 2021","DOI":"10.1016\/S1353-4858(20)30114-8"},{"key":"11_CR26","unstructured":"Microsoft: Optimize reauthentication prompts and understand session lifetime for Azure AD multi-factor authentication (2020). https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/concepts-azure-multi-factor-authentication-prompts-session-lifetime. Accessed 29 Apr 2021"},{"key":"11_CR27","unstructured":"Niemietz, M., Schwenk, J.: Owning your home network: router security revisited. CoRR abs\/1506.04112 (2015). http:\/\/arxiv.org\/abs\/1506.04112"},{"key":"11_CR28","unstructured":"ReportLinker: Global multi-factor authentication (MFA) industry (2021). https:\/\/www.reportlinker.com\/p03329771\/Global-Multi-Factor-Authentication-MFA-Industry.html. Accessed 29 Apr 2021"},{"key":"11_CR29","unstructured":"SecDev: Scapy (2021). https:\/\/github.com\/secdev. Accessed 29 Apr 2021"},{"key":"11_CR30","unstructured":"Selenium: Seleniumhq browser automation (2021). https:\/\/www.selenium.dev\/. Accessed 29 Apr 2021"},{"key":"11_CR31","doi-asserted-by":"crossref","unstructured":"Sinigaglia, F., Carbone, R., Costa, G., Zannone, N.: A survey on multi-factor authentication for online banking in the wild. Comput. Secur. 95, 101745 (2020)","DOI":"10.1016\/j.cose.2020.101745"},{"key":"11_CR32","doi-asserted-by":"publisher","unstructured":"Spaulding, J., Nyang, D., Mohaisen, A.: Understanding the effectiveness of typosquatting techniques. In: Proceedings of the ACM\/IEEE Workshop on Hot Topics in Web Systems and Technologies (2017). https:\/\/doi.org\/10.1145\/3132465.3132467","DOI":"10.1145\/3132465.3132467"},{"key":"11_CR33","unstructured":"Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., Cranor, L.F.: Crying wolf: an empirical study of SSL warning effectiveness. In: USENIX Security Symposium, pp. 399\u2013416 (2009)"},{"issue":"25","key":"11_CR34","first-page":"26","volume":"18","author":"ZF Zaaba","year":"2015","unstructured":"Zaaba, Z.F., Boon, T.K.: Examination on usability issues of security warning dialogs. Age 18(25), 26\u201335 (2015)","journal-title":"Age"}],"container-title":["Lecture Notes in Computer Science","Information and Communications Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-15777-6_11","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,7]],"date-time":"2024-03-07T17:06:45Z","timestamp":1709831205000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-15777-6_11"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031157769","9783031157776"],"references-count":34,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-15777-6_11","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"24 August 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}}]}}