Citation Context

...al. studied the cryptographic properties of password managers for mobile devices and their vulnerability to brute force attacks [6]. In concurrent work, Blanchou and Youn [9] as well as Silver et al. =-=[37]-=- found a number of serious flaws in the auto-fill functionality in password managers. In contrast, we analyze a broader range of functionality but focus on third-party web-based password managers only...

Citation Context

...r) have introduced built-in password managers. Standalone password managers [9] (e.g., 1Password and KeePass) and web-based password managers that run in a browser (e.g., LastPass, RoboForm, and PasswordBox) have also become quite popular. However, a password manager alone does not offer sufficient security assurance due to insecure computing environments at either local or remote. Zhao and Yue showed that none of the browser built-in password managers in mainstream web browsers could prevent malware from stealing passwords in a PC environment [10]. Recent studies on web password auto filling [11] and webbased password managers [12] reveal that there exist a number of serious vulnerabilities in popular password managers that can be exploited to launch password attacks and render disastrous consequences. Recent years have witnessed frequent outbreak of data breaches and password database leaks that occurred on prominent websites such as LinkedIn [13], Yahoo! [14], and Gmail [15]. Those password leaks endanger millions of people’s data security not only on those websites but also on other websites due to password reuse [16], [17]. To make matters worse, attackers often launch MITM attack...

Citation Context

...use weak passwords or reuse passwords between different sites, password based login is prone to simple attacks like Phishing or dictionary based attacks, and recently two studies on password managers =-=[1,2]-=- showed all of them to be insecure. SSO schemes have been proposed to replace password based authentication, to enhance both usability and security. A recent non-academic overview [3] claims that 87% ...

Citation Context

...ounts per user has caused people to have to choose between greater inconvenience; engaging in potentially dangerous reuse of passwords across sites [4]; and having to place trust in password managers =-=[13]-=-. As a result, there have been many calls to end the era of the password – e.g., [9, 14]. Biometrics has emerged as one possible solution to the problem of improving both security and user experience ...