What type of study is this?

September 10, 2025Information Security Journal A Global Perspective1 citations

A passwordless MFA utilizing biometrics, proximity, and contactless communication

SSSneha ShuklaGalgotias University GVGaurav VarshneyIndian Institute of Technology Jammu SSShreya SinghIndian Institute of Technology Jammu

Key Points

The proposed MFA scheme improves user verification with real-time facial biometrics and BLE-NFC device interaction.
Initial threat modeling indicates robust protection against phishing attacks, including real-time MITM and malicious extensions.
Usability, deployability, and security were assessed using the Bonneau et al. framework, comparing it favorably to other popular schemes.
The prototype system was successfully implemented on a BLE-NFC-enabled Android device, demonstrating practical feasibility.

Abstract

Despite being more secure and strongly promoted, two-factor (2FA) or multi-factor (MFA) schemes either fail to protect against recent phishing threats, such as real-time MITM, controls/relay MITM, malicious browser extension-based phishing attacks, and/or need users to purchase and carry other hardware for additional account protection. Leveraging the unprecedented popularity of NFC and BLE-enabled smartphones, we explore a new horizon for designing an MFA scheme. This paper introduces an advanced authentication method for user verification that utilizes the user's real-time facial biometric identity, which serves as an inherent factor, together with BLE- NFC-enabled mobile devices, which operate as an ownership factor. We have implemented a prototype authentication system on a BLE-NFC-enabled Android device, and initial threat modeling suggests that it is safe against known phishing attacks. The scheme has been compared with other popular schemes using the Bonneau et al. assessment framework in terms of usability, deploy ability, and security.

Ask AI

Helpful

Bookmark

View Full Paper