FreeAuth: Privacy-Preserving Email Ownership Authentication with Verification-Email-Free
Yijia Fang, Bingyu Li, Jiale Xiao, Bo Qin, Zhijintong Zhang, Qianhong Wu · 2024
Electronic mail, as one of the most widely used identifiers, is extensively utilized for account registration and recovery, two-factor authentication, and organizational identification. Traditional email ownership authentication is typically achieved through verification codes or links sent via email, which leads to full disclosure of a user’s email address.We propose FreeAuth, an innovative and universal email ownership authentication scheme that enhances privacy by allowing users to selectively disclose email-related information. FreeAuth distinguishes itself from precedents by eschewing verification emails, thus avoiding spam marking and online behavior tracking. It establishes an authentication interaction paradigm based on widely deployed email transmission protocols, such as SMTP, IMAP, and POP3, ensuring legacy compatibility and server obliviousness. Meanwhile, it utilizes TLS Oracle schemes to protect data privacy by disclosing only the authentication outcome of the interaction, rather than revealing the full email address. FreeAuth can be integrated as an alternative to traditional email ownership authentication schemes.We present details of FreeAuth architecture and instantiations of prototype systems, along with three tailored examples of selective email address disclosures to align with various scenario requirements. The experimental analysis indicates that FreeAuth is compatible with up to 96% of existing email providers, and it is notably efficient, requiring only 2.5 seconds of online time to complete ownership authentication in our wide area network settings.