during this type of attack a malicious actor will acquire a user's password and launch a login session simultaneously as the primary user gaining access to the user's login credentials if the attacker and user log in simultaneously the user's device will receive two "push to approve" notifications because there is no fundamental difference between the two notifications they could unknowingly accept the attacker's notification giving them access to sensitive information (banking school etc) an early solution the researchers developed which is mentioned in their european symposium on security and privacy paper consisted of using a random four-digit number the user would have to compare and match to accept the notification with this type of approach however there's a high chance that they will not look at it close enough and accept the attacker's notification "there is a large amount of literature in the usability security community showing that people don't pay attention to these security notifications warnings and things of that nature " said saxena "they bypass them by pressing the ok button so that they can connect and pursue their main task they don't anticipate an attack so we didn't want to use this method" to address this design flaw the researchers designed a new method called replicate with replicate users need to approve the login attempt by replicating a randomized interaction presented on the browser session over on the login notification explicitly binding the notification to the user's browser session for example the user would be instructed to drag a key icon in a particular direction in one interaction in another interaction the user would be shown colored buttons and press the correct one while the interactions are simple to perform they will prevent a concurrency attack from occurring because the interaction required to validate the user's session will differ from the interaction the attacker will be required to perform to approve their session to test the effectiveness of the interface the team conducted a usability study with 40-50 participants where they evaluated and compared its efficacy to the "just tap" method they found that the study participants could successfully carry out the simple tasks efficiently with little to no errors "if the attacker were to log in at the same time to carry out an attack against this method they wouldn't succeed because the user is matching their browser session with the notification and wouldn't be able to accept the attacker notification " said saxena in addition to studying replicate's effectiveness with a larger study group to better measure its usability and adaptability in practice the researchers want to increase the randomness of the process of matching the browser session with the notification "for example when you look at the number of options for the key drag interaction the randomness involved in this process is very low if the user receives two notifications one saying 'drag it up' and the other 'drag it down ' the user could pick the attacker's notification perform that operation and accept it although we did not see it in the study there's still a small possibility that it could happen so that would be one thing we need to solve" saxena also recently received a grant from the national science foundation to study the security and usability of push-based two-factor authentication systems and potential security vulnerabilities contributors to this line of research include mohammed jubur the university of alabama birmingham; prakash shrestha jay prakash clarice chua qing yuy silence laboratories singapore; tanvi ravindra thombre andrei bytes lucienne blessing jianying zhou tony quek singapore university of technology and design singapore