Protecting password piracy using authentication protocol

For past few decades, the text password is the primary means of user authentication in websites. The users select their passwords on their own. The password based authentication resist against brute force attacks and dictionary attacks. But the user passwords are prone to be stolen and can be compromised to attacks and vulnerabilities. First, the user reuses the password for several websites as it is difficult to remember several passwords. This lead to the loss of sensitive information and hackers can easily intrude into user accounts. If one of the websites password is compromised then the intruder can gain access to more websites. Second, the users may enter the passwords into untrusted systems may lead to password thief threat. The adversaries can launch several password attacks such as phishing, key loggers and malware. In this paper, an authentication protocol is proposed which requires a user's cellphone, an untrusted system, a telecommunication provider and a web server. It comprises of three phases: Registration phase, Login phase and Recovery phase. Here users have to remember only a long-term password for login to all websites.