The Emperorís New Password Manager: Security Analysis of Web-based Password Managers
Author(s): Zhiwei Li, Warren He, Devdatta Akhawe, Dawn Song

Date: August 2014
Publication: Proceedings of the 23rd USENIX Security Symposium
Publisher: USENIX
Source 1: http://devd.me/papers/pwdmgr-usenix14.pdf
Source 2: https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/li_zhiwei

Abstract:
We conduct a security analysis of five popular web-based password managers. Unlike ďlocalĒ password managers, web-based password managers run in the browser. We identify four key security concerns for web-based password managers and, for each, identify representative vulnerabilities through our case studies. Our attacks are severe: in four out of the five password managers we studied, an attacker can learn a userís credentials for arbitrary websites. We find vulnerabilities in diverse features like one-time passwords, bookmarklets, and shared passwords. The root-causes of the vulnerabilities are also diverse: ranging from logic and authorization mistakes to misunderstandings about the web security model, in addition to the typical vulnerabilities like CSRF and XSS. Our study suggests that it remains to be a challenge for the password managers to be secure. To guide future development of password managers, we provide guidance for password managers. Given the diversity of vulnerabilities we identified, we advocate a defense-in-depth approach to ensure security of password managers.



Do you have additional information to contribute regarding this research paper? If so, please email siteupdates@passwordresearch.com with the details.

<-- Back to Authentication Research Paper Index





[Home] [About Us] [News] [Research]

Copyright © 2016 PasswordResearch.com