  Two-factor authentication protects online accounts even if passwords are
leaked. Most users, however, prefer password-only authentication. One reason
why two-factor authentication is so unpopular is the extra steps that the user
must complete in order to log in. Currently deployed two-factor authentication
mechanisms require the user to interact with his phone to, for example, copy a
verification code to the browser. Two-factor authentication schemes that
eliminate user-phone interaction exist, but require additional software to be
deployed.
  In this paper we propose Sound-Proof, a usable and deployable two-factor
authentication mechanism. Sound-Proof does not require interaction between the
user and his phone. In Sound-Proof the second authentication factor is the
proximity of the user's phone to the device being used to log in. The proximity
of the two devices is verified by comparing the ambient noise recorded by their
microphones. Audio recording and comparison are transparent to the user, so
that the user experience is similar to the one of password-only authentication.
Sound-Proof can be easily deployed as it works with current phones and major
browsers without plugins. We build a prototype for both Android and iOS. We
provide empirical evidence that ambient noise is a robust discriminant to
determine the proximity of two devices both indoors and outdoors, and even if
the phone is in a pocket or purse. We conduct a user study designed to compare
the perceived usability of Sound-Proof with Google 2-Step Verification.
Participants ranked Sound-Proof as more usable and the majority would be
willing to use Sound-Proof even for scenarios in which two-factor
authentication is optional.
