TY - JOUR
T1 - Toward a secure and usable cloud-based password manager for web browsers
AU - Zhao, Rui
AU - Yue, Chuan
N1 - Funding Information:
The authors sincerely thank anonymous reviewers for their valuable suggestions and comments. This research was supported in part by the U.S. National Science Foundation under grant CNS-1359542 .
PY - 2014/10
Y1 - 2014/10
N2 - Web users are confronted with the daunting challenges of creating, remembering, and using more and more strong passwords than ever before in order to protect their valuable assets on different websites. Password manager, particularly Browser-based Password Manager (BPM), is one of the most popular approaches designed to address these challenges by saving users' passwords and later automatically filling the login forms on behalf of users. Fortunately, all the five most popular Web browsers have provided password managers as a useful built-in feature. In this paper, we uncover the vulnerabilities of existing BPMs and analyze how they can be exploited by attackers to crack users' saved passwords. Moreover, we propose a novel Cloud-based Storage-Free BPM (CSF-BPM) design to achieve a high level of security with the desired confidentiality, integrity, and availability properties. We have implemented a CSF-BPM system into Firefox and evaluated its correctness, performance, and usability. Our evaluation results and analysis demonstrate that CSF-BPM can be efficiently and conveniently used. We believe CSF-BPM is a rational design that can also be integrated into other popular browsers to make the online experience of Web users more secure, convenient, and enjoyable.
AB - Web users are confronted with the daunting challenges of creating, remembering, and using more and more strong passwords than ever before in order to protect their valuable assets on different websites. Password manager, particularly Browser-based Password Manager (BPM), is one of the most popular approaches designed to address these challenges by saving users' passwords and later automatically filling the login forms on behalf of users. Fortunately, all the five most popular Web browsers have provided password managers as a useful built-in feature. In this paper, we uncover the vulnerabilities of existing BPMs and analyze how they can be exploited by attackers to crack users' saved passwords. Moreover, we propose a novel Cloud-based Storage-Free BPM (CSF-BPM) design to achieve a high level of security with the desired confidentiality, integrity, and availability properties. We have implemented a CSF-BPM system into Firefox and evaluated its correctness, performance, and usability. Our evaluation results and analysis demonstrate that CSF-BPM can be efficiently and conveniently used. We believe CSF-BPM is a rational design that can also be integrated into other popular browsers to make the online experience of Web users more secure, convenient, and enjoyable.
KW - Cloud
KW - Password manager
KW - Security
KW - Storage
KW - User authentication
KW - Web browser
UR - http://www.scopus.com/inward/record.url?scp=84905241561&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84905241561&partnerID=8YFLogxK
U2 - 10.1016/j.cose.2014.07.003
DO - 10.1016/j.cose.2014.07.003
M3 - Article
AN - SCOPUS:84905241561
SN - 0167-4048
VL - 46
SP - 32
EP - 47
JO - Computers and Security
JF - Computers and Security
ER -