![](bg8.png)
identity. In the context of authentication, this can
be achieved following several attacks: The attacker
can either try to impersonate the RP in order to send
false authentication requests to the user (T1). Alter-
natively, he can try to imitate the users identity to
authenticate against the RP (T2).
Tampering. Whereas any involved system is consid-
ered to be secure, the Tampering attack is limited to
the modification of data in transit. As Figure 1 out-
lines, this can be achieved by either modifying the
transmitted authentication data or its request.
Similar to the second Spoofing attack vector, an at-
tacker can modify the authentication request in tran-
sit to obtain an authentication from the victim. Alter-
natively, it is also possible to pretend a false identity
by faking a compromised authentication. Therefore,
scenarios T1 and T2 are appropriate representations
for this threat as well.
Repudiation. In this scenario, the victim, which is
also the attacker at the same time, denies being re-
sponsible for an actually executed authentication.
Therefore, this attack vector is equivalent to scenario
T3.
Information Disclosure. Information Disclosure at-
tacks target the protection goal of confidentiality. In
this context, possible weak points are the authentica-
tion and its request in transit. Generally spoken it can
be divided, whether the stolen data can be directly
used for a following attack or for identity inference
only. While the first case is identical to a Spoofing at-
tack and hence covered by scenarios T1 and T2, the
latter one is described by T4.
Denial of Service. The goal of a Denial of Service
attack is to cause security vulnerabilities by disturb-
ing the services availability. Since authentication
providers only build the base for other applications,
the concrete risk of an outage does not represent a
relevant attack vector for this work.
Elevation of Privilege. None of the introduced ap-
proaches offer an inherent right management, hence
this vector does not match the purpose of authentica-
tion. However, attackers may gain higher permission
by stealing foreign identities (T1).
5 CONCLUSION
In this paper, we’ve described Remote WebAuthn, a
novel authentication method related to FIDO2. Re-
mote WebAuthn focuses on providing security close
to FIDO2, on devices with restricted capabilities or
interfaces and limited software support, such as Smart
TVs. This publication covers the theoretical working
mechanisms as well as an example implementation
which is also publicly available online for everyone to
use. The example implementation (RemoteWebAu-
thn, 2020) was designed, such that device manufac-
turers could implement our method with ease. We
have thoroughly evaluated usability based on Bon-
neau’s sophisticated aspects (Bonneau et al., 2012)
as well as the security based on Microsoft’s STRIDE
model (Microsoft, 1999). We concluded, that the se-
curity level of our approach is higher than password
based authentication and slightly weaker compared to
FIDO2. However, our method provides a higher us-
ability compared to both alternatives. As future work,
we see the development of an example implementa-
tion of an iOS client among the already existing An-
droid client. With the publication of this paper as well
as the example implementation, we’re looking for-
ward establishing a new open standard for restricted
devices such as Smart TVs and increase the overall
security of such products.
REFERENCES
Bonneau, J., Herley, C., Van Oorschot, P. C., and Stajano,
F. (2012). The quest to replace passwords: A frame-
work for comparative evaluation of web authentica-
tion schemes. In IEEE S&P.
Bonneau, J. and Preibusch, S. (2010). The password thicket:
Technical and market failures in human authentication
on the web. In WEIS.
FIDO-specs (2020). Fido specifications overview. https:
//fidoalliance.org/specifications.
Florêncio, D. and Herley, C. (2010). Where do security
policies come from? In SOUPS.
Kohnfelder, L. and Garg, P. (1999). The threats to our prod-
ucts. Microsoft Interface, Microsoft Corporation.
Krypton (2020). Krypton website. https://krypt.co.
Lindemann, R. (2018). Fido security reference.
https://fidoalliance.org/specs/fido-v2.0-rd-20180702/
fido-security-ref-v2.0-rd-20180702.pdf.
Lyastani, S. G., Schilling, M., Neumayr, M., Backes, M.,
and Bugiel, S. (2020). Is FIDO2 the kingslayer of
user authentication? A comparative usability study of
FIDO2 passwordless authentication. In IEEE S&P.
Microsoft (1999). The stride threat model.
https://docs.microsoft.com/en-us/previous-versions/
commerce-server/ee823878(v=cs.20).
Reese, K., Smith, T., Dutson, J., Armknecht, J., Cameron,
J., and Seamons, K. (2019). A usability study of five
two-factor authentication methods. In SOUPS.
RemoteWebAuthn (2020). Remote WebAuthn source code.
https://github.com/pkwagner/remote-webauthn.
Schneier, B. (1999). Attack trees. Dr. Dobb’s journal.
Voigt, J. (2019). 5 sicherheitstipps zum safer inter-
net day. https://germany.googleblog.com/2019/02/
5-sicherheitstipps-zum-safer-internet-day.html.
Remote WebAuthn: FIDO2 Authentication for Less Accessible Devices
375