Red Button and Yellow Button: Usable Security for Lost Security Tokens

Conference Object
Change log
Goldberg, I 
Jenkinson, G 
Llewellyn-Jones, D 

Currently, losing a security token places the user in a dilemma: reporting the loss as soon as it is discovered involves a significant burden which is usually overkill in the common case that the token is later found behind a sofa. Not reporting the loss, on the other hand, puts the security of the protected account at risk and potentially leaves the user liable.

We propose a simple architectural solution with wide applicability that allows the user to reap the security benefit of reporting the loss early, but without paying the corresponding usability penalty if the event was later discovered to be a false alarm.

46 Information and Computing Sciences, 4604 Cybersecurity and Privacy
Journal Title
Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Conference Name
Cambridge International Workshop on Security Protocols
Journal ISSN
Volume Title
10368 LNCS
European Research Council (307224)
The authors with a Cambridge affiliation are grateful to the European Research Council for funding this research through grant StG 307224 (Pico). Goldberg thanks NSERC for grant RGPIN-341529. We also thank the workshop attendees for comments.