This paper presents a Trojan-based proof-of-concept attack that compromises WebAuthn sessions in real-world settings and highlights critical vulnerabilities in current WebAuthn deployments, calling attention to the need for stronger endpoint security and architectural safeguards.
Aditya Mitra, V. S. Devi Priya, S. Chakkaravarthy et al.· Telecommunications Systems· 0 citations
This work critically reassess the FIDO2 threat model and shows that several commonly assumed security properties do not hold under realistic deployment conditions, and concludes that effective FIDO2 security requires layered mitigations covering the browser, operating system, hardware, protocol stack, and metadata infr...
Aditya Mitra, K. Abhiram, S. C. Sethuraman et al.· 0 citations
The proposed novel password reset standard performs authentication and password update in a single cryptographically bound flow, eliminating the need for sessions, cookies, OTPs, or email-based verification, and mitigating phishing, session hijacking, CSRF, and replay attacks.
Aditya Mitra, Amar Kumar Mandal, Amaan Rais Shah et al.· 0 citations
This paper proposes an architecture based on the Selective Disclosure JSON Web Token (SD-JWT) standard for securely sharing read-only files, which embeds cryptographic signatures and integrity protection directly into the shared resource, providing verifiable authenticity without relying on complex IAM infrastructures.
