The Experts below are selected from a list of 636 Experts worldwide ranked by ideXlab platform
P C Van Oorschot - One of the best experts on this subject based on the ideXlab platform.
-
tapas design implementation and usability evaluation of a Password manager
Annual Computer Security Applications Conference, 2012Co-Authors: Daniel Mccarney, David Barrera, Jeremy Clark, Sonia Chiasson, P C Van OorschotAbstract:Passwords continue to prevail on the web as the primary method for user authentication despite their well-known security and usability drawbacks. Password managers offer some improvement without requiring server-side changes. In this paper, we evaluate the security of dual-possession authentication, an authentication approach offering encrypted storage of Passwords and theft-resistance without the use of a Master Password. We further introduce Tapas, a concrete implementation of dual-possession authentication leveraging a desktop computer and a smartphone. Tapas requires no server-side changes to websites, no Master Password, and protects all the stored Passwords in the event either the primary or secondary device (e.g., computer or phone) is stolen. To evaluate the viability of Tapas as an alternative to traditional Password managers, we perform a 30 participant user study comparing Tapas to two configurations of Firefox's built-in Password manager. We found users significantly preferred Tapas. We then improve Tapas by incorporating feedback from this study, and reevaluate it with an additional 10 participants.
-
exploration and field study of a Password manager using icon based Passwords
Financial Cryptography, 2011Co-Authors: Kemal Bicakci, Nart Bedin Atalay, Mustafa Yuceel, P C Van OorschotAbstract:We carry out a hybrid lab and field study of a Password manager program, and report on usability and security. Our study explores iPMAN, a browser-based Password manager that in addition uses a graphical Password scheme for the Master Password. We present our findings as a set of observations and insights expected to be of interest both to those exploring Password managers, and graphical Passwords.
-
Exploration and Field Study of a Browser-based Password Manager using Icon-based Passwords ?
2011Co-Authors: Kemal Bicakci, Nart Bedin Atalay, Mustafa Yuceel, P C Van OorschotAbstract:We carry out a hybrid lab and eld study of a Password manager program, and report on usability and security. Our study explores iPMAN, a browser-based Password manager that in addition uses a graphical Password scheme for the Master Password. We present our ndings as a set of observations and insights expected to be of interest both to those exploring Password managers, and graphical Passwords. Motivated by our ndings, but also of independent interest, we also present a new salt generation method using blind signatures, to protect against oine attacks, decreasing user inconvenience by generating salt signicantly faster than earlier work (Halderman et al. 2005).
-
exploration and field study of a browser based Password manager using icon based Passwords
2011Co-Authors: Kemal Bicakci, Nart Bedin Atalay, Mustafa Yuceel, P C Van OorschotAbstract:We carry out a hybrid lab and eld study of a Password manager program, and report on usability and security. Our study explores iPMAN, a browser-based Password manager that in addition uses a graphical Password scheme for the Master Password. We present our ndings as a set of observations and insights expected to be of interest both to those exploring Password managers, and graphical Passwords. Motivated by our ndings, but also of independent interest, we also present a new salt generation method using blind signatures, to protect against oine attacks, decreasing user inconvenience by generating salt signicantly faster than earlier work (Halderman et al. 2005).
Nitesh Saxena - One of the best experts on this subject based on the ideXlab platform.
-
a hidden Password online Password manager
ACM Symposium on Applied Computing, 2021Co-Authors: Maliheh Shirvanian, Nitesh Saxena, Stanislaw Jarecki, Christopher Robert Price, Mohammed Jubur, Hugo KrawczykAbstract:The most commonly adopted Password management technique is to store web account Passwords on a Password manager and lock them using a Master Password. However, current online Password managers do not hide the account Passwords or the Master Password from the Password manager itself, which highlights their real-world vulnerability and lack of user confidence in the face of malicious insiders and outsiders that compromise the Password management service especially given its online nature. We attempt to address this crucial vulnerability in the design of online Password managers by proposing HIPPO, a cloud-based Password manager that does not learn or store Master Passwords and account Passwords. HIPPO is based on the cryptographic notion of device-enhanced Password authenticated key exchange proven by Jarecki et al. to resist online guessing attacks and dictionary attacks. We introduce the HIPPO protocol design and report on a full implementation of the system.
-
building and studying a Password store that perfectly hides Passwords from itself
IEEE Transactions on Dependable and Secure Computing, 2019Co-Authors: Maliheh Shirvanian, Nitesh Saxena, Stanislaw Jarecki, Hugo KrawczykAbstract:We introduce a novel approach to Password management, called SPHINX, which remains secure even when the Password manager itself has been compromised. In SPHINX, the information stored on the device is theoretically independent of the user's Master Password. Moreover, an attacker with full control of the device, even at the time the user interacts with it, learns nothing about the Master Password - the Password is not entered into the device in plaintext form or in any other way that may leak information on it. Unlike existing managers, SPHINX produces strictly high-entropy Passwords and makes it compulsory for the users to register these Passwords with the web services, which defeats online guessing attacks and offline dictionary attack upon service compromise. We present the design, implementation and performance evaluation of SPHINX, offering prototype browser plugins, smartphone apps and transparent device-client communication. We further provide a comparative analytical evaluation of SPHINX with other Password managers based on a formal framework consisting of security, usability, and deployability metrics.
-
SPHINX: A Password Store that Perfectly Hides Passwords from Itself
2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), 2017Co-Authors: Maliheh Shirvanian, Stanislaw Jareckiy, Hugo Krawczykz, Nitesh SaxenaAbstract:Password managers (aka stores or vaults) allow a user to store and retrieve (usually high-entropy) Passwords for her multiple Password-protected services by interacting with a “device” serving the role of the manager (e.g., a smartphone or an online third-party service) on the basis of a single memorable (low-entropy) Master Password. Existing Password managers work well to defeat offline dictionary attacks upon web service compromise, assuming the use of high-entropy Passwords is enforced. However, they are vulnerable to leakage of all Passwords in the event the device is compromised, due to the need to store the Passwords encrypted under the Master Password and/or the need to input the Master Password to the device (as in smartphone managers). Evidence exists that Password managers can be attractive attack targets. In this paper, we introduce a novel approach to Password management, called SPHINX, which remains secure even when the Password manager itself has been compromised. In SPHINX, the information stored on the device is information theoretically independent of the user's Master Password - an attacker breaking into the device learns no information about the Master Password or the user's site-specific Passwords. Moreover, an attacker with full control of the device, even at the time the user interacts with it, learns nothing about the Master Password - the Password is not entered into the device in plaintext form or in any other way that may leak information on it. Unlike existing managers, SPHINX produces strictly high-entropy Passwords and makes it compulsory for the users to register these randomized Passwords with the web services, hence fully defeating offline dictionary attack upon service compromise. The design and security of SPHINX is based on the device-enhanced PAKE model of Jarecki et al. that provides the theoretical basis for this construction and is backed by rigorous cryptographic proofs of security. While SPHINX is suitable for different device and online platforms, in this paper, we report on its concrete instantiation on smartphones given their popularity and trustworthiness as Password managers (or even two-factor authentication). We present the design, implementation and performance evaluation of SPHINX, offering prototype browser plugins, smartphone apps and transparent device-client communication. Based on our inspection analysis, the overall user experience of SPHINX improves upon current managers. We also report on a lab-based usability study of SPHINX, which indicates that users' perception of SPHINX security and usability is high and satisfactory when compared to regular Password-based authentication. Finally, we discuss how SPHINX may be extended to an online service for the purpose of back-up or as an independent Password manager.
Maliheh Shirvanian - One of the best experts on this subject based on the ideXlab platform.
-
a hidden Password online Password manager
ACM Symposium on Applied Computing, 2021Co-Authors: Maliheh Shirvanian, Nitesh Saxena, Stanislaw Jarecki, Christopher Robert Price, Mohammed Jubur, Hugo KrawczykAbstract:The most commonly adopted Password management technique is to store web account Passwords on a Password manager and lock them using a Master Password. However, current online Password managers do not hide the account Passwords or the Master Password from the Password manager itself, which highlights their real-world vulnerability and lack of user confidence in the face of malicious insiders and outsiders that compromise the Password management service especially given its online nature. We attempt to address this crucial vulnerability in the design of online Password managers by proposing HIPPO, a cloud-based Password manager that does not learn or store Master Passwords and account Passwords. HIPPO is based on the cryptographic notion of device-enhanced Password authenticated key exchange proven by Jarecki et al. to resist online guessing attacks and dictionary attacks. We introduce the HIPPO protocol design and report on a full implementation of the system.
-
building and studying a Password store that perfectly hides Passwords from itself
IEEE Transactions on Dependable and Secure Computing, 2019Co-Authors: Maliheh Shirvanian, Nitesh Saxena, Stanislaw Jarecki, Hugo KrawczykAbstract:We introduce a novel approach to Password management, called SPHINX, which remains secure even when the Password manager itself has been compromised. In SPHINX, the information stored on the device is theoretically independent of the user's Master Password. Moreover, an attacker with full control of the device, even at the time the user interacts with it, learns nothing about the Master Password - the Password is not entered into the device in plaintext form or in any other way that may leak information on it. Unlike existing managers, SPHINX produces strictly high-entropy Passwords and makes it compulsory for the users to register these Passwords with the web services, which defeats online guessing attacks and offline dictionary attack upon service compromise. We present the design, implementation and performance evaluation of SPHINX, offering prototype browser plugins, smartphone apps and transparent device-client communication. We further provide a comparative analytical evaluation of SPHINX with other Password managers based on a formal framework consisting of security, usability, and deployability metrics.
-
SPHINX: A Password Store that Perfectly Hides Passwords from Itself
2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), 2017Co-Authors: Maliheh Shirvanian, Stanislaw Jareckiy, Hugo Krawczykz, Nitesh SaxenaAbstract:Password managers (aka stores or vaults) allow a user to store and retrieve (usually high-entropy) Passwords for her multiple Password-protected services by interacting with a “device” serving the role of the manager (e.g., a smartphone or an online third-party service) on the basis of a single memorable (low-entropy) Master Password. Existing Password managers work well to defeat offline dictionary attacks upon web service compromise, assuming the use of high-entropy Passwords is enforced. However, they are vulnerable to leakage of all Passwords in the event the device is compromised, due to the need to store the Passwords encrypted under the Master Password and/or the need to input the Master Password to the device (as in smartphone managers). Evidence exists that Password managers can be attractive attack targets. In this paper, we introduce a novel approach to Password management, called SPHINX, which remains secure even when the Password manager itself has been compromised. In SPHINX, the information stored on the device is information theoretically independent of the user's Master Password - an attacker breaking into the device learns no information about the Master Password or the user's site-specific Passwords. Moreover, an attacker with full control of the device, even at the time the user interacts with it, learns nothing about the Master Password - the Password is not entered into the device in plaintext form or in any other way that may leak information on it. Unlike existing managers, SPHINX produces strictly high-entropy Passwords and makes it compulsory for the users to register these randomized Passwords with the web services, hence fully defeating offline dictionary attack upon service compromise. The design and security of SPHINX is based on the device-enhanced PAKE model of Jarecki et al. that provides the theoretical basis for this construction and is backed by rigorous cryptographic proofs of security. While SPHINX is suitable for different device and online platforms, in this paper, we report on its concrete instantiation on smartphones given their popularity and trustworthiness as Password managers (or even two-factor authentication). We present the design, implementation and performance evaluation of SPHINX, offering prototype browser plugins, smartphone apps and transparent device-client communication. Based on our inspection analysis, the overall user experience of SPHINX improves upon current managers. We also report on a lab-based usability study of SPHINX, which indicates that users' perception of SPHINX security and usability is high and satisfactory when compared to regular Password-based authentication. Finally, we discuss how SPHINX may be extended to an online service for the purpose of back-up or as an independent Password manager.
Kemal Bicakci - One of the best experts on this subject based on the ideXlab platform.
-
exploration and field study of a Password manager using icon based Passwords
Financial Cryptography, 2011Co-Authors: Kemal Bicakci, Nart Bedin Atalay, Mustafa Yuceel, P C Van OorschotAbstract:We carry out a hybrid lab and field study of a Password manager program, and report on usability and security. Our study explores iPMAN, a browser-based Password manager that in addition uses a graphical Password scheme for the Master Password. We present our findings as a set of observations and insights expected to be of interest both to those exploring Password managers, and graphical Passwords.
-
Exploration and Field Study of a Browser-based Password Manager using Icon-based Passwords ?
2011Co-Authors: Kemal Bicakci, Nart Bedin Atalay, Mustafa Yuceel, P C Van OorschotAbstract:We carry out a hybrid lab and eld study of a Password manager program, and report on usability and security. Our study explores iPMAN, a browser-based Password manager that in addition uses a graphical Password scheme for the Master Password. We present our ndings as a set of observations and insights expected to be of interest both to those exploring Password managers, and graphical Passwords. Motivated by our ndings, but also of independent interest, we also present a new salt generation method using blind signatures, to protect against oine attacks, decreasing user inconvenience by generating salt signicantly faster than earlier work (Halderman et al. 2005).
-
exploration and field study of a browser based Password manager using icon based Passwords
2011Co-Authors: Kemal Bicakci, Nart Bedin Atalay, Mustafa Yuceel, P C Van OorschotAbstract:We carry out a hybrid lab and eld study of a Password manager program, and report on usability and security. Our study explores iPMAN, a browser-based Password manager that in addition uses a graphical Password scheme for the Master Password. We present our ndings as a set of observations and insights expected to be of interest both to those exploring Password managers, and graphical Passwords. Motivated by our ndings, but also of independent interest, we also present a new salt generation method using blind signatures, to protect against oine attacks, decreasing user inconvenience by generating salt signicantly faster than earlier work (Halderman et al. 2005).
Christoph Busch - One of the best experts on this subject based on the ideXlab platform.
-
cloud Password manager using privacy preserved biometrics
IEEE International Conference on Cloud Engineering, 2014Co-Authors: Bian Yang, Huiguang Chu, Slobodan Petrovic, Guoqiang Li, Christoph BuschAbstract:Using one Password for all web services is not secure because the leakage of the Password compromises all the web services accounts, while using independent Passwords for different web services is inconvenient for the identity claimant to memorize. A Password manager is used to address this security-convenience dilemma by storing and retrieving multiple existing Passwords using one Master Password. On the other hand, a Password manager liberates human brain by enabling people to generate strong Passwords without worry about memorizing them. While a Password manager provides a convenient and secure way to managing multiple Passwords, it centralizes the Passwords storage and shifts the risk of Passwords leakage from distributed service providers to a software or token authenticated by a single Master Password. Concerned about this one Master Password based security, biometrics could be used as a second factor for authentication by verifying the ownership of the Master Password. However, biometrics based authentication is more privacy concerned than a non-biometric Password manager. In this paper we propose a cloud Password manager scheme exploiting privacy enhanced biometrics, which achieves both security and convenience in a privacy-enhanced way. The proposed Password manager scheme relies on a cloud service to synchronize all local Password manager clients in an encrypted form, which is efficient to deploy the updates and secure against untrusted cloud service providers.