Graeme Jenkinson, Max Spencer, Chris Warrington, Frank Stajano: I Bought a New Security Token and All I Got Was This Lousy Phish - Relay Attacks on Visual Code Authentication Schemes. Security Protocols Workshop 2014: 197-215