Toward a secure and usable cloud-based password manager for web browsers

Rui Zhao, Chuan Yue

Research output: Contribution to journalArticlepeer-review

18 Scopus citations

Abstract

Web users are confronted with the daunting challenges of creating, remembering, and using more and more strong passwords than ever before in order to protect their valuable assets on different websites. Password manager, particularly Browser-based Password Manager (BPM), is one of the most popular approaches designed to address these challenges by saving users' passwords and later automatically filling the login forms on behalf of users. Fortunately, all the five most popular Web browsers have provided password managers as a useful built-in feature. In this paper, we uncover the vulnerabilities of existing BPMs and analyze how they can be exploited by attackers to crack users' saved passwords. Moreover, we propose a novel Cloud-based Storage-Free BPM (CSF-BPM) design to achieve a high level of security with the desired confidentiality, integrity, and availability properties. We have implemented a CSF-BPM system into Firefox and evaluated its correctness, performance, and usability. Our evaluation results and analysis demonstrate that CSF-BPM can be efficiently and conveniently used. We believe CSF-BPM is a rational design that can also be integrated into other popular browsers to make the online experience of Web users more secure, convenient, and enjoyable.

Original languageEnglish (US)
Pages (from-to)32-47
Number of pages16
JournalComputers and Security
Volume46
DOIs
StatePublished - Oct 2014
Externally publishedYes

Keywords

  • Cloud
  • Password manager
  • Security
  • Storage
  • User authentication
  • Web browser

ASJC Scopus subject areas

  • Computer Science(all)
  • Law

Fingerprint

Dive into the research topics of 'Toward a secure and usable cloud-based password manager for web browsers'. Together they form a unique fingerprint.

Cite this