System and method for authentication with out-of-band user interaction

1. A method for authenticating a party to a secure transaction, comprising:

receiving, at a second computing device, an out-of-band user interaction protocol;

receiving, from a first computing device on behalf of a first party at the second computing device of a second party, first information associated with a secure transaction between the first party and the second party;

receiving, from the first computing device at the second computing device, first video or audio evidence of one or more actions taken by the first party;

capturing, by the second computing device during presentation of the first video or audio evidence by the second computing device, acknowledgement of the one or more actions taken by the first party as observed or heard by the second party in the first video or audio evidence;

determining, by the second computing device dependent on the captured acknowledgement, whether or not the one or more actions observed or heard by the second party match actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol; and

determining, by the second computing device dependent on whether or not the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol, whether to accept the first information associated with the secure transaction.

2. The method of claim 1 , wherein:

the first information is a public key of a public-private key pair created on behalf of the first party for potential use when exchanging information between the first party and the second party; and

the method further comprises:

accepting, by the second computing device in response to determining that the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol, the public key;

receiving, from the first computing device, second information associated with the secure transaction; and

using, by the second computing device, the public key to decrypt the second information.

3. The method of claim 1 , wherein:

the first information comprises an identifier of the first party; and

the method further comprises:

authenticating, by the second computing device in response to determining that the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol, the identifier of the first party; and

subsequent to authenticating the identifier of the first party, allowing the secure transaction between the first party and the second party to proceed.

4. The method of claim 1 , wherein:

the secure transaction comprises a transfer of funds from the second party to the first party; and

the first information comprises payment instructions received from the first computing device on behalf of the first party.

5. The method of claim 1 , wherein:

the first computing device comprises a server of third party to the secure transaction;

the first information is received from the server on behalf of the first party; and

the first video or audio evidence is received from the server on behalf of the first party.

6. The method of claim 1 , wherein:

the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol comprise:

communicating, in response to prompting by the first computing device, a sequence of tokens generated by the first computing device in accordance with the out-of-band user interaction protocol; and

recording the communicating using a video camera or voice recorder;

the first video or audio evidence is based on the recording; and

capturing acknowledgement of the one or more actions taken by the first party comprises:

receiving, through a user interface of the second computing device, input identifying the sequence of tokens communicated by the first party as observed or heard by the second party in the first video or audio evidence.

7. The method of claim 1 , further comprising, in response to determining that the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol:

recording, by the second computing device, second video or audio evidence of one or more actions taken by the second party in accordance with the out-of-band user interaction protocol;

providing, to the first computing device, the second video or audio evidence of the one or more actions taken by the second party; and

receiving, from the first computing device, an indication of whether or not actions observed or heard by the first party in the second video or audio evidence match actions expected to have been taken by the second party in accordance with the out-of-band user interaction protocol.

8. The method of claim 1 , further comprising:

refraining from performing the secure transaction between the first party and the second party in response to determining that the one or more actions observed or heard by the second party do not match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol.

9. The method of claim 1 , wherein the first video or audio evidence received from the first device comprises a video stream transmitted to the second device during performance of the one or more actions by the first party, a video memo recorded during performance of the one or more actions by the first party, an audio stream transmitted to the second device during performance of the one or more actions by the first party, or an audio memo recorded during performance of the one or more actions by the first party.

10. A non-transitory computer readable memory media storing instructions executable by a processor of a second computing device of a second party for:

receiving, at the second computing device, an out-of-band user interaction protocol;

receiving, from a first computing device on behalf of a first party at the second computing device of the second party, first information associated with a secure transaction between the first party and the second party;

receiving, from the first computing device at the second computing device, first video or audio evidence of one or more actions taken by the first party;

capturing, by the second computing device during presentation of the first video or audio evidence by the second computing device, acknowledgement of the one or more actions taken by the first party as observed or heard by the second party in the first video or audio evidence;

determining, by the second computing device dependent on the captured acknowledgement, whether or not the one or more actions observed or heard by the second party match actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol;

allowing the secure transaction between the first party and the second party to proceed in response to determining that the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol; and

refraining from performing the secure transaction in response to determining that the one or more actions observed or heard by the second party do not match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol.

11. The non-transitory computer readable memory media of claim 10 , wherein:

the first information is a public key of a public-private key pair created on behalf of the first party for potential use when exchanging information between the first party and the second party; and

the instructions are further executable by the processor for:

accepting, by the second computing device in response to determining that the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol, the public key;

receiving, from the first computing device, second information associated with the secure transaction; and

using, by the second computing device, the public key to decrypt the second information.

12. The non-transitory computer readable memory media of claim 10 , wherein:

the first information comprises an identifier of the first party; and

the instructions are further executable by the processor for:

authenticating, by the second computing device in response to determining that the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol, the identifier of the first party; and

subsequent to authenticating the identifier of the first party, allowing the secure transaction between the first party and the second party to proceed.

13. The non-transitory computer readable memory media of claim 10 , wherein:

the secure transaction comprises a transfer of funds from the second party to the first party; and

the first information comprises payment instructions received from the first computing device on behalf of the first party.

14. The non-transitory computer readable memory media of claim 10 , wherein

the first video or audio evidence includes: a sequence of tokens generated by the first computing device in accordance with the out-of-band user interaction protocol

recorded by a video camera or voice recorder of the first computing device;

capturing acknowledgement of the one or more actions taken by the first party comprises:

receiving, through a user interface of the second computing device, input identifying the sequence of tokens communicated by the first party as observed or heard by the second party in the first video or audio evidence.

15. The non-transitory computer readable memory media of claim 10 , wherein the instructions are further executable by the processor for, in response to determining that the one or more actions observed or heard by the second party match the actions expected to have been taken by the first party in accordance with the out-of-band user interaction protocol:

recording, by the second computing device, second video or audio evidence of one or more actions taken by the second party in accordance with the out-of-band user interaction protocol;

providing, to the first computing device, the second video or audio evidence of the one or more actions taken by the second party; and

receiving, from the first computing device, an indication of whether or not actions observed or heard by the first party in the second video or audio evidence match actions expected to have been taken by the second party in accordance with the out-of-band user interaction protocol.

16. The non-transitory computer readable memory media of claim 10 , wherein the first video or audio evidence received from the first device comprises a video stream transmitted to the second device during performance of the one or more actions by the first party, a video memo recorded during performance of the one or more actions by the first party, an audio stream transmitted to the second device during performance of the one or more actions by the first party, or an audio memo recorded during performance of the one or more actions by the first party.