Bypassing Push-Based Second Factor and Passwordless Authentication with Human-Indistinguishable Notifications

About this work

Abstract

This paper identifies a session-binding weakness in one-push 2FA and passwordless authentication: near-concurrent notifications generated for a legitimate user and an attacker can appear indistinguishable on the user's device. It introduces HIENA, an attack that triggers attacker-controlled authentication attempts around the time of a legitimate login and can additionally mimic contextual information to increase deception. A laboratory user study shows high attacker-notification approval rates—about 83% overall, rising to roughly 99% with spoofed contextual information. The work demonstrates that convenience-oriented push approval can create a fundamental security weakness when the notification is not clearly bound to the user's intended browser session.