Push notification based login using BLE devices

Due to the consistent number of phishing attacks there is a need to develop secure authentication schemes. These days phishing is mostly carried out using malicious browser extensions or other sophisticated credential stealing techniques such as CR/RT MITM phishing attack. Therefore, it is required to develop secure authentication schemes for handling these attacks. A set of popular authentication schemes has been analyzed in this paper and it is found that they are unsafe against credential stealing attacks such as CR/RT MITM phishing, malicious browser extensions, key loggers and malwares. A novel push notification based scheme that uses BTADDR as the user identification token and performs real time modification and verification of BLE device (Bluetooth 4.0+ Version) descriptor value for user authentication has been proposed in this paper. The scheme is better in terms of security provided by the existing two factor authentication schemes (OTP/PIN, QR Code/Barcode, Graphical password/ CAPTCHA) and the usual push notification based login authentication schemes that uses username as the user identification token. Scheme has been compared with other popular schemes using the Bonneau et al. assessment framework in terms of usability, deployability and security. The results obtained are promising which suggest Bluetooth based push notification schemes can be a good option for future web authentication.