Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Is It Really You Who Forgot the Password? When Account Recovery Meets Risk-Based Authentication

Andre Büttner, Andreas Thue Pedersen, Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

TL;DR

This paper presents the first study to investigate risk-based account recovery (RBAR) in the wild and creates a first maturity model for RBAR challenges to help developers, administrators, and policy-makers gain an initial understanding of RBAR.

Abstract

Risk-based authentication (RBA) is used in online services to protect user accounts from unauthorized takeover. RBA commonly uses contextual features that indicate a suspicious login attempt when the characteristic attributes of the login context deviate from known and thus expected values. Previous research on RBA and anomaly detection in authentication has mainly focused on the login process. However, recent attacks have revealed vulnerabilities in other parts of the authentication process, specifically in the account recovery function. Consequently, to ensure comprehensive authentication security, the use of anomaly detection in the context of account recovery must also be investigated. This paper presents the first study to investigate risk-based account recovery (RBAR) in the wild. We analyzed the adoption of RBAR by five prominent online services (that are known to use RBA). Our findings confirm the use of RBAR at Google, LinkedIn, and Amazon. Furthermore, we provide insights into the different RBAR mechanisms of these services and explore the impact of multi-factor authentication on them. Based on our findings, we create a first maturity model for RBAR challenges. The goal of our work is to help developers, administrators, and policy-makers gain an initial understanding of RBAR and to encourage further research in this direction.

Is It Really You Who Forgot the Password? When Account Recovery Meets Risk-Based Authentication

TL;DR

This paper presents the first study to investigate risk-based account recovery (RBAR) in the wild and creates a first maturity model for RBAR challenges to help developers, administrators, and policy-makers gain an initial understanding of RBAR.

Abstract

Risk-based authentication (RBA) is used in online services to protect user accounts from unauthorized takeover. RBA commonly uses contextual features that indicate a suspicious login attempt when the characteristic attributes of the login context deviate from known and thus expected values. Previous research on RBA and anomaly detection in authentication has mainly focused on the login process. However, recent attacks have revealed vulnerabilities in other parts of the authentication process, specifically in the account recovery function. Consequently, to ensure comprehensive authentication security, the use of anomaly detection in the context of account recovery must also be investigated. This paper presents the first study to investigate risk-based account recovery (RBAR) in the wild. We analyzed the adoption of RBAR by five prominent online services (that are known to use RBA). Our findings confirm the use of RBAR at Google, LinkedIn, and Amazon. Furthermore, we provide insights into the different RBAR mechanisms of these services and explore the impact of multi-factor authentication on them. Based on our findings, we create a first maturity model for RBAR challenges. The goal of our work is to help developers, administrators, and policy-makers gain an initial understanding of RBAR and to encourage further research in this direction.
Paper Structure (20 sections, 3 figures, 6 tables)

This paper contains 20 sections, 3 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Risk-Based Account Recovery
  4. Methodology
  5. Experiment 1: RBAR Use by Google
  6. Preparation
  7. Results
  8. Experiment 2: RBAR Use by Other Services
  9. Preparation
  10. Identifying RBAR Usage
  11. Analyzing the Influence of MFA Settings on Account Recovery on LinkedIn
  12. Results and Discussion
  13. Experiment Results
  14. Maturity Model
  15. Comparison with Official Documentation
  16. ...and 5 more sections

Figures (3)

  • Figure 1: Overview of the RBAR procedure (based on RBA illustration in Wiefling_Verify_2021)
  • Figure 2: Message shown when failing Google's account recovery using an unknown browser and an unknown IP address. It reveals information that might give indications of their inner RBAR workings.
  • Figure 3: Error message for phone recovery, when also Text Message MFA is activated