I need a help to understand some specific points about non-repudiation, nonetheless I implemented some authentication methods:
- Digital Signature Authentication;
- CHAP (Challenge Authentication Protocol)
- Zero-knowledge password proof
Let's imagine a situation that a user is authenticated either by TFA or SFA to his bank system using some devices with virtual MAC Addresses or other ways I don't know to hide device identity. The user makes some transactions, then goes to the bank complaining for an attack on his/her account and claiming for a money recovery.
How could we prevent this situation without Digital Signature Authentication? Can we do this with just TFA or are there some ways to do this? I don't think the user can be unmasked by finding his IP provided by some DHP. Is there a way to at least find the user's real MAC Address?