  Both authentication and deauthentication are instrumental for preventing
unauthorized access to computer and data assets. While there are obvious
motivating factors for using strong authentication mechanisms, convincing users
to deauthenticate is not straight-forward, since deauthentication is not
considered mandatory. A user who leaves a logged-in workstation unattended
(especially for a short time) is typically not inconvenienced in any way; in
fact, the other way around: no annoying reauthentication is needed upon return.
However, an unattended workstation is trivially susceptible to the well-known
"lunchtime attack" by any nearby adversary who simply takes over the departed
user's log-in session. At the same time, since deathentication does not
intrinsically require user secrets, it can, in principle, be made unobtrusive.
To this end, this paper designs the first automatic user deauthentication
system, FADEWICH, that does not rely on biometric- or behavior-based techniques
(e.g., keystroke dynamics) and does not require users to carry any devices. It
uses physical properties of wireless signals and the effect of human bodies on
their propagation. To assess FADEWICH's feasibility and performance, extensive
experiments were conducted with its prototype. Results show that it suffices to
have nine inexpensive wireless sensors deployed in a shared office setting to
correctly deauthenticate all users within six seconds (90% within four seconds)
after they leave their workstation's vicinity. We considered two realistic
scenarios where the adversary attempts to subvert FADEWICH and showed that
lunchtime attacks fail.
