A Passwordless MFA Utlizing Biometrics, Proximity and Contactless Communication

TL;DR

This paper proposes a novel passwordless multi-factor authentication scheme combining facial biometrics and contactless communication via NFC and BLE, aiming to enhance security against phishing and improve usability.

Contribution

It introduces a new MFA method leveraging biometric and contactless device factors, implemented on smartphones, and evaluated against existing schemes for security and usability.

Findings

Prototype system implemented on Android devices

Initial threat modeling indicates resistance to known phishing attacks

Compared favorably with existing MFA schemes in usability and security

Abstract

Despite being more secure and strongly promoted, two-factor (2FA) or multi-factor (MFA) schemes either fail to protect against recent phishing threats such as real-time MITM, controls/relay MITM, malicious browser extension-based phishing attacks, and/or need the users to purchase and carry other hardware for additional account protection. Leveraging the unprecedented popularity of NFC and BLE-enabled smartphones, we explore a new horizon for designing an MFA scheme. This paper introduces an advanced authentication method for user verification that utilizes the user's real-time facial biometric identity, which serves as an inherent factor, together with BLE- NFC-enabled mobile devices, which operate as an ownership factor. We have implemented a prototype authentication system on a BLE-NFC-enabled Android device, and initial threat modeling suggests that it is safe against known phishing attacks. The scheme has been compared with other popular schemes using the Bonneau et al. assessment framework in terms of usability, deployability, and security.