Abstract or Summary:
We come up with a solution that protects users’ passwords from being spied out by an untrusted user’s host during the password-based authentication to a server. The main advantage of our solution is that it does not require any modifications on the server-side. While smartcard producers have presented cards that support TLS, our approach has been tested on cards that are available at low cost to end customers.