On the Security of Trustee-based Social Authentications

Recently, trustee-based social authentication, i.e., authenticating users with the help of their friends, has been shown to be a promising backup authentication mechanism. A user in such a system is associated with a few (e.g., 5) trustees selected from the user's friends by either the user or the service provider. When the user wants to regain access to the account, the service provider sends different verification codes to the accounts held by his or her trustees. The user must obtain at least k (i.e., recovery threshold) verification codes from the trustees and present them to the service provider before being directed to reset his or her password. In this paper, we provide the first systematic study about the security of trustee-based social authentications. Specifically, we first introduce a novel framework of attacks, which we call forest fire attacks. In these attacks, an attacker initially obtains a small number of compromised users, and then the attacker iteratively attacks the rest of users by exploiting trustee-based social authentications. Then, we construct a probabilistic model to formalize the threats of forest fire attacks and their costs for attackers. Moreover, we introduce various defense strategies. Finally, we apply our framework to extensively evaluate various attack and defense strategies using three real-world social network datasets. Our results have strong implications for the design of more secure trustee-based social authentications.