{"id":"https://openalex.org/W4388594071","doi":"https://doi.org/10.1145/3632175","title":"Sound-based Two-factor Authentication: Vulnerabilities and Redesign","display_name":"Sound-based Two-factor Authentication: Vulnerabilities and Redesign","publication_year":2023,"publication_date":"2023-11-11","ids":{"openalex":"https://openalex.org/W4388594071","doi":"https://doi.org/10.1145/3632175"},"language":"en","primary_location":{"id":"doi:10.1145/3632175","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3632175","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3632175","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3632175","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017417273","display_name":"Prakash Shrestha","orcid":"https://orcid.org/0000-0002-7779-6399"},"institutions":[{"id":"https://openalex.org/I4210131910","display_name":"Centro Universit\u00e1rio da Funda\u00e7\u00e3o Educacional Guaxup\u00e9","ror":"https://ror.org/03bzmm215","country_code":"BR","type":"education","lineage":["https://openalex.org/I4210131910"]},{"id":"https://openalex.org/I4401727004","display_name":"Equifax (United States)","ror":"https://ror.org/05yk70j08","country_code":null,"type":"company","lineage":["https://openalex.org/I4401727004"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Prakash Shrestha","raw_affiliation_strings":["Equifax Inc. USA","Equifax Inc., USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Equifax Inc. USA","institution_ids":["https://openalex.org/I4210131910"]},{"raw_affiliation_string":"Equifax Inc., USA","institution_ids":["https://openalex.org/I4401727004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065458594","display_name":"Ahmed Tanvir Mahdad","orcid":"https://orcid.org/0009-0002-4136-7004"},"institutions":[{"id":"https://openalex.org/I91045830","display_name":"Texas A&M University","ror":"https://ror.org/01f5ytq51","country_code":"US","type":"education","lineage":["https://openalex.org/I91045830"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ahmed Tanvir Mahdad","raw_affiliation_strings":["Texas A&amp;M University, USA"],"raw_orcid":"https://orcid.org/0009-0002-4136-7004","affiliations":[{"raw_affiliation_string":"Texas A&amp;M University, USA","institution_ids":["https://openalex.org/I91045830"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059730489","display_name":"Nitesh Saxena","orcid":"https://orcid.org/0000-0001-6083-104X"},"institutions":[{"id":"https://openalex.org/I91045830","display_name":"Texas A&M University","ror":"https://ror.org/01f5ytq51","country_code":"US","type":"education","lineage":["https://openalex.org/I91045830"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nitesh Saxena","raw_affiliation_strings":["Texas A&amp;M University, USA"],"raw_orcid":"https://orcid.org/0000-0001-6083-104X","affiliations":[{"raw_affiliation_string":"Texas A&amp;M University, USA","institution_ids":["https://openalex.org/I91045830"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6524,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.66306046,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":"27","issue":"1","first_page":"1","last_page":"27"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":0.9959999918937683,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6954885721206665},{"id":"https://openalex.org/keywords/login","display_name":"Login","score":0.6725270748138428},{"id":"https://openalex.org/keywords/phone","display_name":"Phone","score":0.5905262231826782},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5495324730873108},{"id":"https://openalex.org/keywords/factor","display_name":"Factor (programming language)","score":0.5470831990242004},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.5460926294326782},{"id":"https://openalex.org/keywords/wearable-computer","display_name":"Wearable computer","score":0.47323688864707947},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.45912137627601624},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.43838974833488464},{"id":"https://openalex.org/keywords/multi-factor-authentication","display_name":"Multi-factor authentication","score":0.4137450158596039},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.14045432209968567}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6954885721206665},{"id":"https://openalex.org/C113324615","wikidata":"https://www.wikidata.org/wiki/Q472302","display_name":"Login","level":2,"score":0.6725270748138428},{"id":"https://openalex.org/C2778707766","wikidata":"https://www.wikidata.org/wiki/Q202064","display_name":"Phone","level":2,"score":0.5905262231826782},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5495324730873108},{"id":"https://openalex.org/C2781039887","wikidata":"https://www.wikidata.org/wiki/Q1391724","display_name":"Factor (programming language)","level":2,"score":0.5470831990242004},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.5460926294326782},{"id":"https://openalex.org/C150594956","wikidata":"https://www.wikidata.org/wiki/Q1334829","display_name":"Wearable computer","level":2,"score":0.47323688864707947},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.45912137627601624},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.43838974833488464},{"id":"https://openalex.org/C194699767","wikidata":"https://www.wikidata.org/wiki/Q7878662","display_name":"Multi-factor authentication","level":4,"score":0.4137450158596039},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.14045432209968567},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C21564112","wikidata":"https://www.wikidata.org/wiki/Q4825885","display_name":"Authentication protocol","level":3,"score":0.0},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3632175","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3632175","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3632175","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3632175","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3632175","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3632175","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.41999998688697815,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G4074060405","display_name":"SaTC: TTP: Small: SPHINX: A Password Store that Perfectly Hides Passwords from Itself","funder_award_id":"2152669","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4131819877","display_name":"Collaborative Research: SaTC: TTP: Medium: Intrusion-Tolerant Outsourced Storage for Cyber-Infrastructure","funder_award_id":"2201465","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8377161673","display_name":"CICI: UCSS: Towards Secure and Usable Push Notification Authentication for Collaborative Scientific Infrastructures","funder_award_id":"2139358","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4388594071.pdf","grobid_xml":"https://content.openalex.org/works/W4388594071.grobid-xml"},"referenced_works_count":23,"referenced_works":["https://openalex.org/W32836451","https://openalex.org/W1596662236","https://openalex.org/W1989085188","https://openalex.org/W1990556702","https://openalex.org/W2019380907","https://openalex.org/W2022423863","https://openalex.org/W2030112111","https://openalex.org/W2033811191","https://openalex.org/W2059942829","https://openalex.org/W2079024329","https://openalex.org/W2114477274","https://openalex.org/W2122514667","https://openalex.org/W2152718950","https://openalex.org/W2158291955","https://openalex.org/W2168076624","https://openalex.org/W2170458454","https://openalex.org/W2350778671","https://openalex.org/W2534878473","https://openalex.org/W2788272605","https://openalex.org/W2810116884","https://openalex.org/W2896384017","https://openalex.org/W2903508140","https://openalex.org/W6600808634"],"related_works":["https://openalex.org/W2931897859","https://openalex.org/W2001345885","https://openalex.org/W2784017372","https://openalex.org/W2363363251","https://openalex.org/W4309172146","https://openalex.org/W4238865314","https://openalex.org/W4291701200","https://openalex.org/W2784315464","https://openalex.org/W192327621","https://openalex.org/W3010813109"],"abstract_inverted_index":{"Reducing":[0],"the":[1,28,31,36,43,46,60,106,112,123,127,144,154,165,168,189,192],"level":[2],"of":[3,59,167],"user":[4,47,107],"effort":[5],"involved":[6],"in":[7,171],"traditional":[8],"two-factor":[9],"authentication":[10,161],"(TFA)":[11],"constitutes":[12],"an":[13],"important":[14],"research":[15],"topic.":[16],"An":[17],"interesting":[18],"representative":[19],"approach,":[20],"Sound-Proof":[21,61],",":[22,88],"leverages":[23],"ambient":[24],"sounds":[25,202],"to":[26,48,68,109,143,188,198],"detect":[27],"proximity":[29,79,175],"between":[30],"second-factor":[32],"device":[33,97],"(phone)":[34],"and":[35,40,72,78,99,122,139],"login":[37,124],"terminal":[38],"(browser),":[39],"it":[41,65,182],"eliminates":[42],"need":[44],"for":[45],"transfer":[49],"PIN":[50],"codes.":[51],"In":[52],"this":[53,132],"article,":[54],"we":[55,85],"identify":[56],"a":[57,89,95,115],"weakness":[58],"system":[62],"that":[63],"makes":[64],"completely":[66],"vulnerable":[67],"passive":[69],"\u201cenvironment":[70,74],"guessing\u201d":[71],"active":[73,100],"manipulating\u201d":[75],"remote":[76,149],"attackers":[77],"attackers.":[80],"Addressing":[81],"these":[82],"security":[83],"issues,":[84],"propose":[86],"Listening-Watch":[87],"new":[90],"TFA":[91],"mechanism":[92],"based":[93],"on":[94],"wearable":[96,193],"(watch/bracelet)":[98],"browser-generated":[101],"random":[102,117,169],"speech":[103,136],"sounds.":[104],"As":[105],"attempts":[108],"log":[110],"in,":[111],"browser":[113],"populates":[114],"short":[116],"code":[118,133,170],"encoded":[119],"into":[120],"speech,":[121],"succeeds":[125],"if":[126],"watch\u2019s":[128,172],"audio":[129,146],"recording":[130],"contains":[131],"(decoded":[134],"using":[135],"recognition":[137],")":[138],"is":[140,183],"similar":[141],"enough":[142],"browser\u2019s":[145],"recording.":[147],"The":[148,174],"attacker,":[150],"who":[151],"has":[152],"guessed/manipulated":[153],"user\u2019s":[155],"environment,":[156],"will":[157,177],"be":[158,179],"defeated,":[159],"since":[160,191],"success":[162],"relies":[163],"upon":[164],"presence":[166],"recordings.":[173],"attacker":[176],"also":[178],"defeated":[180],"unless":[181],"extremely":[184],"close":[185],"(<50":[186],"cm)":[187],"watch,":[190],"microphones":[194],"are":[195],"usually":[196],"designed":[197],"capture":[199],"only":[200],"nearby":[201],"(e.g.,":[203],"voice":[204],"commands).":[205]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}