Current mobile payment schemes gather detailed information about purchases customers make. This data can then be used to infer a customer’s spending behaviour, potentially violating their privacy. To tackle this problem, we propose an untraceable mobile payment scheme that strikes a better balance, preserving user privacy while allowing the Third-Party Service Provider (TPSP) to collect necessary information such as card details and transaction amount for regulatory compliance. Our scheme offers untraceability for legitimate users from malicious adversaries and curious TPSPs using cryptographic primitives such as partially blind signatures, zero-knowledge proofs, and identity-based signatures. It also guarantees that only authorised TPSPs can issue valid payment tokens, and even with limited data, the TPSP can still prevent dishonest customers/merchants from double-spending a payment token. We also propose a comprehensive evaluation framework to assess the untraceable payment schemes against seven key criteria such as untraceability, exculpability—merchant double-spending, exculpability—customer double-spending, unforgeability, confidentiality, message authenticity, efficiency, and regulatory compliance. We rigorously benchmark the security and privacy of our proposed payment scheme against this framework and other established schemes. Furthermore, we formally verify these properties using complexity-based analysis and Proverif modelling.
Ahmad AA Alkhatib, Layla Albdor, Seraj Fayyad, Hussain Ali
The rapid expansion of Internet of Things (IoT) devices underscores the critical importance of robust security protocols, particularly in the realm of children's toys. This study introduces an innovative multi-factor authentication strategy integrating Quick Response (QR) codes with Blockchain technology to fortify the security of IoT toys designed for children. The primary objective is to safeguard young users against potential threats stemming from unauthorized access, thereby ensuring a secure interaction with IoT-enabled toys. By amalgamating authentication factors, including QR codes, the proposed approach establishes a multilayered security framework. Leveraging the inherent immutability and transparency of Blockchain, the system verifies the authenticity of IoT toys by scanning a unique QR code, thus mitigating risks associated with malwares and unauthorized access. The decentralization of Blockchain ensures no single point of failure, enhancing resilience against cyber threats. Extensive usability studies underscore the efficacy and practicality of the advanced multi-factor authentication solution, poised to elevate the safety standards of IoT toys in the digital age. This innovative approach not only bolsters security but also fosters trust among users, enabling seamless and worry-free interaction with IoT-enabled toys for children worldwide.
Zain Ul Islam Adil, Majid Iqbal Khan, Kahkishan Sanam, Saif Ur Rehman Malik · 6 authors
ABSTRACT Counterfeit medical devices pose a threat to patient safety, necessitating a secure device authentication system for medical applications. Resource‐constrained sensory nodes are vulnerable to hacking, prompting the need for robust security measures. Token‐based authentication schemes, such as one‐time passwords (OTPs), smart cards, key fobs, and mobile authentication apps, along with certificate‐based authentication methods, such as client and code‐signing, employ cryptographic frameworks like elliptical curve cryptography (ECC) and physical unclonable functions (PUF). However, these methods face challenges, including block sequence issues and susceptibility to side‐channel attacks. To address these issues, we propose a framework for mutual authentication using private Ethereum. This framework integrates private Ethereum and cryptographic techniques for encrypting and decrypting data using mathematical algorithms to overcome block sequence issues and side‐channel attacks. Similarly, fog nodes are utilised to enhance local computing, storage, and networking capabilities for sensors. The framework is evaluated using metrics such as communication costs, execution costs, and computation costs based on Ethereum gas consumption. The performance of the LightAuth framework is compared with that of the Smart Contracts Against Counterfeit IoMT (SCACIoMT) framework, designed for Internet of Medical Things (IoMT) devices. The effectiveness of LightAuth is verified through formal security analysis using BAN logic.
With the advancement of cutting-edge technologies, the Internet of Medical Things (IoMT) has assisted the healthcare sector by facilitating interaction between healthcare service providers and patients in remote areas. In IoMT, wearable or implantable sensors collect the patient’s record and share the information through a public network. Health-related information about the patient must be protected from a variety of attacks by the adversary since it is sensitive and extremely vulnerable to attacks. The sensor equipment that is implanted in the patient is also resource-constrained and has a low power capacity. The entities involved in the communication must be authenticated with one another in order to protect patients’ health information, anonymity, and reliability. While several authenticated key agreement protocols have been proposed, many suffer from high computational costs and storage cost, making them unsuitable for lightweight applications. This paper proposes a secure three-factor robust Elliptic Curve Cryptography (ECC) based mutually authenticated and key agreement protocol known as RELAKA for the IoMT environment, utilizing the benefits of one-way hash function. In proposed scheme, all entities, including the healthcare service providers and wearable sensors, are authenticated by the medical server. Subsequently, a secret key is established for each communication session and shared between all the entities. Additionally, mechanism for appropriate user revocation and re-registration is integrated to provide additional security in cases where a user’s QR code is tampered with by the attacker. The privacy of the proposed protocol is investigated by the potential use of zero knowledge proof. Furthermore, the efficacy of the authentication is examined by challenge and response mechanism. The informal security analysis demonstrates its resistance to threats such as DoS, impersonation, message modification, password guessing, and so on. The performance evaluation of RELAKA protocol indicates that the execution, communication, and storage costs is reduced by 87.59%, 43% and 60.71% respectively. Moreover, the outcomes of the AVISPA simulation illustrate that the RELAKA successfully evades both active and passive attacks. In addition, real-world testbed environment is developed with Raspberry pi 4 model B and the experimental results verifies the robustness of the proposed protocol. According to theoretical analysis and experimental evaluation, the RELAKA scheme is more secure and efficient than the existing protocols.
This article proposes a novel method for managing usage counters within an anonymous credential system, addressing the limitation of traditional anonymous credentials in tracking repeated use. The method takes advantage of blockchain technology through Smart Contracts deployed on the Ethereum network to enforce a predetermined maximum number of uses for a given credential. Users retain control over increments by providing zero-knowledge proofs (ZKPs) demonstrating private key possession and agreement on the increment value. This approach prevents replay attacks and ensures transparency and security. A prototype implementation on a private Ethereum blockchain demonstrates the feasibility and efficiency of the proposed method, paving the way for its potential deployment in real-world applications requiring both anonymity and usage tracking.
Current authentication schemes based on zero-knowledge proof (ZKP) still face issues such as high computation costs, low efficiency, and security assurance difficulty. Therefore, we propose a secure and efficient authentication scheme (SEAS) for large-scale IoT devices based on ZKP. In the initialization phase, the trusted authority creates prerequisites for device traceability and system security. Then, we propose a new registration method to ensure device anonymity. In the identity tracing and revocation phase, we revoke the real identity of abnormal devices by decrypting and updating group public keys, avoiding their access and reducing revocation costs. In the authentication phase, we check the arithmetic relationship between blind certificates, proofs, and other random data. We propose a new anonymous batch authentication method to effectively reduce computation costs, enhance authentication efficiency, and guarantee device authentication security. Security analysis and experimental results show that an SEAS can ensure security and effectively reduce verification time and energy costs. Its security and performance exceed existing schemes.
Open access
User Authentication and Security Systems
Advanced Steganography and Watermarking Techniques
IT has made significant progress in various fields over the past few years, with many industries transitioning from paper-based to electronic media. However, sharing electronic medical records remains a long-term challenge, particularly when patients are in emergency situations, making it difficult to access and control their medical information. Previous studies have proposed permissioned blockchains with limited participants or mechanisms that allow emergency medical information sharing to pre-designated participants. However, permissioned blockchains require prior participation by medical institutions, and limiting sharing entities restricts the number of potential partners. This means that sharing medical information with local emergency doctors becomes impossible if a patient is unconscious and far away from home, such as when traveling abroad. To tackle this challenge, we propose an emergency access control system for a global electronic medical information system that can be shared using a public blockchain, allowing anyone to participate. Our proposed system assumes that the patient wears a pendant with tamper-proof and biometric authentication capabilities. In the event of unconsciousness, emergency doctors can perform biometrics on behalf of the patient, allowing the family doctor to share health records with the emergency doctor through a secure channel that uses the Diffie-Hellman (DH) key exchange protocol. The pendant's biometric authentication function prevents unauthorized use if it is stolen, and we have tested the blockchain's fee for using the public blockchain, demonstrating that the proposed system is practical.
Abstract Non-Fungible Tokens (NFTs) are becoming increasingly popular as a way to represent and own digital property. However, the usage of NFTs also prompts questions about privacy. In this work, we show that it is possible to use NFTs to retrieve enough information to fingerprint users. By doing so, we can uniquely associate users with blockchain accounts. This would allow linking several blockchain accounts to the same user. This work focuses on the vulnerabilities presented by some popular NFT marketplaces. Since NFTs may have HTML files embedded, they allow the use of fingerprinting techniques if not handled carefully. Finally, we provide recommendations and countermeasures for the different actors in this ecosystem to avoid these kinds of tracking methods and, in doing so, safeguard user privacy.
Open access
Advanced Steganography and Watermarking Techniques
The increased use of artificial intelligence generated content (AIGC) among vast user populations has heightened the risk of private data leaks. Effective auditing and regulation remain challenging, further compounding the risks associated with the leaks involving model parameters and user data. Blockchain technology, renowned for its decentralized consensus mechanism and tamper-resistant properties, is emerging as an ideal tool for documenting, auditing, and analyzing the behaviors of all stakeholders in machine learning as a service (MLaaS). This study centers on biometric recognition systems, addressing pressing privacy and security concerns through innovative endeavors. We conducted experiments to analyze six distinct deep neural networks, leveraging a dataset quality metric grounded in the query output space to quantify the value of the transfer datasets. This analysis revealed the impact of imbalanced datasets on training accuracy, thereby bolstering the system's capacity to detect model data thefts. Furthermore, we designed and implemented a novel Bio-Rollup scheme, seamlessly integrating technologies such as certificate authority, blockchain layer two scaling, and zero-knowledge proofs. This innovative scheme facilitates lightweight auditing through Merkle proofs, enhancing efficiency while minimizing blockchain storage requirements. Compared to the baseline approach, Bio-Rollup restores the integrity of the biometric system and simplifies deployment procedures. It effectively prevents unauthorized use through certificate authorization and zero-knowledge proofs, thus safeguarding user privacy and offering a passive defense against model stealing attacks.
Charlotte McCabe, Althaff Irfan Cader Mohideen, Raman Singh
Passwords are the first line of defence against preventing unauthorised access to systems and potential leakage of sensitive data. However, the traditional reliance on username and password combinations is not enough protection and has prompted the implementation of technologies such as two-factor authentication (2FA). While 2FA enhances security by adding a layer of verification, these techniques are not impervious to threats. Even with the implementation of 2FA, the relentless efforts of cybercriminals present formidable obstacles in securing digital spaces. The objective of this work is to implement blockchain technology as a form of 2FA. The findings of this work suggest that blockchain-based 2FA methods could strengthen digital security compared to conventional 2FA methods.
Ehsanul Islam Zafir, Afifa Akter, Muhammad Najam-ul-Islam, Shahid A. Hasib · 7 authors
The Internet of Robotic Things (IoRT) integrates robots and autonomous devices, transforming industries such as manufacturing, healthcare, and transportation. However, security vulnerabilities in IoRT systems pose significant challenges to data privacy and system integrity. To address these issues, encryption is essential for protecting sensitive data transmitted between devices. By converting data into ciphertext, encryption ensures confidentiality and integrity, reducing the risk of unauthorized access and data breaches. Blockchain technology also enhances IoRT security by offering decentralized, tamper-proof data storage solutions. By offering comprehensive insights, practical recommendations, and future directions, this paper aims to contribute to the advancement of knowledge and practice in securing interconnected robotic systems, thereby ensuring the integrity and confidentiality of data exchanged within IoRT ecosystems. Through a thorough examination of encryption requisites, scopes, and current implementations in IoRT, this paper provides valuable insights for researchers, engineers, and policymakers involved in IoRT security efforts. By integrating encryption and blockchain technologies into IoRT systems, stakeholders can foster a secure and dependable environment, effectively manage risks, bolster user confidence, and expedite the widespread adoption of IoRT across diverse sectors. The findings of this study underscore the critical role of encryption and blockchain technology in IoRT security enhancement and highlight potential avenues for further exploration and innovation. Furthermore, this paper suggests future research areas, such as threat intelligence and analytics, security by design, multi-factor authentication, and AI for threat detection. These recommendations support ongoing innovation in securing the evolving IoRT landscape.
Biagio Boi, Franco Cirillo, Marco De Santis, Christian Esposito
Context: The digitalization of the healthcare sector faces significant challenges due to the diverse representation of data and their distribution across various hospitals. Moreover, security is a key concern as healthcare-related data are subject to the legal obligations of General Data Protection Regulation (GDPR) and similar data protection legislation. Standardization efforts like Health Level Seven (HL7) have been implemented to enhance data interoperability. However, authentication still remains a critical issue with significant challenges. Aim: This research aims to improve and strengthen the authentication process by introducing a novel architecture for decentralized authentication. Additionally, it proposes a new approach to decentralized data management, which is crucial for handling sensitive medical data efficiently. Methodology: The proposed architecture adopts a user-centric approach, utilizing Self-Sovereign Identity (SSI). It introduced a new non-fungible token (NFT) type called soulbound token (SBT) in the medical context, which will facilitate user authentication across different hospitals, effectively creating a federation of interconnected institutions. Results: The implementation of the proposed architecture demonstrated a significant reduction in authentication time across multiple hospitals. The use of SBT ensured secure and seamless user authentication, enhancing overall system interoperability and data security. The decentralized approach also mitigated the risks associated with centralized authentication servers. Conclusion: This study successfully presents a novel decentralized authentication architecture for the healthcare domain, leveraging SSI and SBTs. This approach accelerates the authentication process and enhances data security and interoperability among hospitals. Future research should explore the scalability of this architecture and its application in other sectors requiring stringent data security measures.
This paper presents an innovative Web 3.0 authentication technique, designed for a user-centric internet environment. Addressing the rising demand for authentication techniques suitable for Web 3.0, it defines the essential features of such systems and introduces a new approach using smart contracts. This approach utilizes mother and child tokens in conjunction with the lock smart contract to ensure secure authentication. The approach is thoroughly tested against various security threats, including man-in-the-middle, replay, and brute-force attacks, and its practicality is evaluated on Ethereum-based networks.
Samuel Hand, Alexander Koch, Pascal Lafourcade, Daiki Miyahara · 5 authors
Abstract A zero-knowledge proof (ZKP) allows a prover to prove to a verifier that it knows some secret, such as a solution to a difficult puzzle, without revealing any information about it. In recent years, ZKP protocols using only a deck of playing cards for solutions to various pencil puzzles have been proposed. The previous work of Lafourcade et al. deals with a famous puzzle called Slitherlink. Their proposed protocol can verify that a solution forms a single loop without revealing anything about the solution, except this fact. Their protocol guarantees that the solution satisfies the single-loop condition, by interactively constructing a solution starting from a state that holds a simple single loop, and proceeding via steps that preserve the invariant of encoding a single loop, until the proper solution is reached. A drawback of their protocol is that it requires additional verifications to guarantee a single loop. In this study, we propose a more efficient ZKP protocol for such a puzzle with fewer additional verifications. For this, we employ the previous work of Robert et al., which addressed the connectivity property in a puzzle. That is, we verify that a solution is connected but not split, to be a single loop. Applying our proposal, we construct a card-based ZKP protocol for Moon-or-Sun, which has its specific rule of alternating pattern in addition to the single-loop condition.
Open access
Advanced Steganography and Watermarking Techniques
The emergence of the Internet of Things (IoT), Industry 5.0 applications and associated services have caused a powerful transition in the cyber threat landscape. As a result, organisations require new ways to proactively manage the risks associated with their infrastructure. In response, a significant amount of research has focused on developing efficient Cyber Threat Intelligence (CTI) sharing. However, in many cases, CTI contains sensitive information that has the potential to leak valuable information or cause reputational damage to the sharing organisation. While a number of existing CTI sharing approaches have utilised blockchain to facilitate privacy, it can be highlighted that a comprehensive approach that enables dynamic trust-based decision-making, facilitates decentralised trust evaluation and provides CTI producers with highly granular sharing of CTI is lacking. Subsequently, in this paper, we propose a blockchain-based CTI sharing framework, called Priv-Share, as a promising solution towards this challenge. In particular, we highlight that the integration of differential sharing, trustless delegation, democratic group managers and incentives as part of Priv-Share ensures that it can satisfy these criteria. The results of an analytical evaluation of the proposed framework using both queuing and game theory demonstrate its ability to provide scalable CTI sharing in a trustless manner. Moreover, a quantitative evaluation of an Ethereum proof-of-concept prototype demonstrates that applying the proposed framework within real-world contexts is feasible.
The telemedicine sector has entered a new phase marked by the integration of Internet of Things (IoT) devices to identify and then send patient health data to medical terminals for additional diagnostic and therapeutic procedures. Today, patients can receive prompt and expert medical care at home in comfortable settings. Due to the unique nature of these services, it is essential to verify patient healthcare data, as it contains a greater amount of personal information that is vulnerable to privacy violations and data breaches. Blockchain technology has attracted interest in addressing security concerns due to its decentralized, immutable, shared, and distributed characteristics. This study proposes lightweight dynamic blockchain-enabled encryption schemes to secure physiological data during authentication and exchange processes. The proposed scheme introduces the logistic Advanced Encryption Scheme (AES) that combines chaotic logistic maps to secure the data in the blockchain network and mitigate different attacks. The model was deployed on the Ethereum blockchain and performance metrics, such as computation and transaction time, were calculated and compared with other current blockchain-inspired encryption models. Furthermore, the NIST test was conducted to prove the strength of the proposed scheme. The proposed model exhibits high security and a shorter transaction time (0.964 s) than other existing schemes. Finally, the proposed model generates high-dynamic keys that are suitable for defending against unpredictable attacks on blockchain.
Chunjie Guo, Lin You, Xingyu Li, Gengran Hu · 6 authors
Biometric authentication is a very convenient and user-friendly method. The popularity of this method requires strong privacy-preserving technology to prevent the disclosure of template information. Most of the existing privacy protection technologies rely on classic encryption techniques, such as homomorphic encryption, which incur huge system overhead and cannot be popularized. To address these issues, we propose a novel biometric authentication scheme with privacy protection based on support vector machine and zero knowledge proof (BioAu–SVM+ZKP). BioAu–SVM+ZKP allows users to authenticate themselves to different service providers without disclosing any biometric template information. The evidence is generated through the zero-knowledge proof utilizing polynomial commitments. Our approach for generating a unique and repeatable biometric identifier from the user’s fingerprint image leverages the multi-classification property of SVM. Notably, our scheme not only reduces the communication overhead but also provides the privacy protection features. Besides, the communication overhead of BioAu–SVM+ZKP is constant. We have simulated the authentication scheme on the common dataset NIST, analyzed the performance and proved the security.
Open access
Biometric Identification and Security
User Authentication and Security Systems
Advanced Steganography and Watermarking Techniques
Mingyi Liu, Jun Ho Huh, HyungSeok Han, Jaehyuk Lee · 8 authors
Decentralized Finance (DeFi) offers a whole new investment experience and has quickly emerged as an enticing alternative to Centralized Finance (CeFi). Rapidly growing market size and active users, however, have also made DeFi a lucrative target for scams and hacks, with 1.95 billion USD lost in 2023. Unfortunately, no prior research thoroughly investigates DeFi users' security risk awareness levels and the adequacy of their risk mitigation strategies. Based on a semi-structured interview study (N = 14) and a follow-up survey (N = 493), this paper investigates DeFi users' security perceptions and commonly adopted practices, and how those affected by previous scams or hacks (DeFi victims) respond and try to recover their losses. Our analysis shows that users often prefer DeFi over CeFi due to their decentralized nature and strong profitability. Despite being aware that DeFi, compared to CeFi, is prone to more severe attacks, users are willing to take those risks to explore new investment opportunities. Worryingly, most victims do not learn from previous experiences; unlike victims studied through traditional systems, DeFi victims tend to find new services, without revising their security practices, to recover their losses quickly. The abundance of various DeFi services and opportunities allows victims to continuously explore new financial opportunities, and this reality seems to cloud their security priorities. Indeed, our results indicate that DeFi users' strong financial motivations outweigh their security concerns - much like those who are addicted to gambling. Our observations about victims' post-incident behaviors suggest that stronger control in the form of industry regulations would be necessary to protect DeFi users from future breaches.
H S Byun, Jueun Kim, Yun-Seok Jeong, Byoungjin Seok · 6 authors
Currently, the monetary value of cryptocurrencies is extremely high, leading to frequent theft attempts. Cyberattacks targeting cryptocurrency wallets and the scale of these attacks are also increasing annually. However, many studies focus on large-scale exchanges, leading to a lack of research on cryptocurrency wallet security. Nevertheless, the threat to individual wallets is real and can lead to severe consequences for individuals. In this paper, we analyze the security of the open-source cryptocurrency wallets Sparrow, Etherwall, and Bither against brute-force attacks, a fundamental threat in password-based systems. As cryptocurrency wallets use passwords to manage users’ private keys, we analyzed the private key management mechanism and implemented a password verification oracle. We used this oracle for brute-force attacks. We identified the private key management mechanism by conducting a code-level investigation and evaluated the three wallets’ security through practical experimentation. The experiment results revealed that the wallets’ security, which depends on passwords, could be diminished due to the password input space and the configuration of password length settings. We propose a general methodology for analyzing the security of desktop cryptocurrency wallets against brute-force attacks and provide practical guidelines for designing secure wallets. By using the analysis methods suggested in this paper, one can evaluate the security of wallets.
Shalitha Wijethilaka, Awaneesh Kumar Yadav, An Braeken, Madhusanka Liyanage
The rapid evolution of heterogeneous applications signifies the requirement for network slicing to cater to diverse network requirements. Network Functions (NFs), which are the essential elements of network slices, are required to communicate with each other securely to facilitate network services. Certificates are the established method to authenticate each other. However, dynamic certificate management while allowing NFs to communicate in a multi-operator environment is arduous. Also, sharing NFs between network slices originates authorization-related security challenges such as unauthorized service utilization, deceptive Denial of Service attacks, and data leakages from network slices. In this paper, we develop a novel framework to address the security challenges related to authentication and authorization in 5G network slicing systems. A blockchain-based multi-party distributed certificate management framework with secure communication protocols is developed using elliptic curve cryptography to facilitate certificate services for multi-operator environments. Also, we propose a blockchain-based NF authorization framework to mitigate the security vulnerabilities in NF sharing between network slices. We implement the proposed framework using Hyperledger Fabric blockchain with Java chain codes and perform comprehensive experiments to show the significance of our framework.The Ability to mitigate the single point of failure with respect to state-of-the-art, including traditional certificate authorities and blockchain-based certificate authorities, time analysis for certificate generation, and the potential to eliminate the mentioned authorization attacks are some of the experiments conducted.Also, we have shown that our framework is secure using informal and formal (using Real-Or-Random (ROR) logic and Scyther Validation tool) security verification mechanisms.
Saeed Bamashmos, Naveen Chilamkurti, Ahmad Salehi Shahraki
Internet of Things (IoT) technology is evolving over the peak of smart infrastructure with the participation of IoT devices in a wide range of applications. Traditional IoT authentication methods are vulnerable to threats due to wireless data transmission. However, IoT devices are resource- and energy-constrained, so building lightweight security that provides stronger authentication is essential. This paper proposes a novel, two-layered multi-factor authentication (2L-MFA) framework using blockchain to enhance IoT devices and user security. The first level of authentication is for IoT devices, one that considers secret keys, geographical location, and physically unclonable function (PUF). Proof-of-authentication (PoAh) and elliptic curve Diffie-Hellman are followed for lightweight and low latency support. Second-level authentication for IoT users, which are sub-categorized into four levels, each defined by specific factors such as identity, password, and biometrics. The first level involves a matrix-based password; the second level utilizes the elliptic curve digital signature algorithm (ECDSA); and levels 3 and 4 are secured with iris and finger vein, providing comprehensive and robust authentication. We deployed fuzzy logic to validate the authentication and make the system more robust. The 2L-MFA model significantly improves performance, reducing registration, login, and authentication times by up to 25%, 50%, and 25%, respectively, facilitating quicker cloud access post-authentication and enhancing overall efficiency.
Open access
User Authentication and Security Systems
Biometric Identification and Security
Advanced Steganography and Watermarking Techniques
As the field of Web3 continues its rapid expansion, the security of Web3 authentication, often the gateway to various Web3 applications, becomes increasingly crucial. Despite its widespread use as a login method by numerous Web3 applications, the security risks of Web3 authentication have not received much attention. This paper investigates the vulnerabilities in the Web3 authentication process and proposes a new type of attack, dubbed blind message attacks. In blind message attacks, attackers trick users into blindly signing messages from target applications by exploiting users' inability to verify the source of messages, thereby achieving unauthorized access to the target application. We have developed Web3AuthChecker, a dynamic detection tool that interacts with Web3 authentication-related APIs to identify vulnerabilities. Our evaluation of real-world Web3 applications shows that a staggering 75.8% (22/29) of Web3 authentication deployments are at risk of blind message attacks. In response to this alarming situation, we implemented Web3AuthGuard on the open-source wallet MetaMask to alert users of potential attacks. Our evaluation results show that Web3AuthGuard can successfully raise alerts in 80% of the tested Web3 authentications. We have responsibly reported our findings to vulnerable websites and have been assigned two CVE IDs.