A Longitudinal Study on Web-Sites Password Management (in)Security: Evidence and Remedies

Abstract

Single-factor password-based authentication is generally the norm to access online Web-sites. While single-factor authentication is well known to be a weak form of authentication, a further concern arises when considering the possibility for an attacker to recover the user passwords by leveraging the loopholes in the password recovery mechanisms. Indeed, the adoption by a Web-site of a poor password management system makes useless even the most robust password chosen by the registered users. In this paper, building on the results of our previous work, we study the possible attacks to on-line password recovery systems analyzing the mechanisms implemented by some of the most popular Web-sites. In detail, we provide several contributions: (i) we revise and detail the attacker model; (ii) we provide an updated analysis with respect to a preliminary study we carried out in December 2017; (iii) we perform a brand new analysis of the current top 200 Alexa's Web-sites of five major EU countries; and, (iv) we propose Maildust, a working open-source module that could be adopted by any Web-site to provide registered users with a password recovery mechanism to prevent mail service provider-level attacks. Overall, it is striking to notice how the analyzed Web-sites have made little (if any) effort to become compliant with the GDPR regulation, showing that the objective to have basic user protection mechanisms in place-despite the fines threatened by GDPR-is still far, mainly because of sub-standard security management prac-

Do Content Management Systems Impact the Security of Free Content Websites?

“…The cost of using FCWs has been investigated in [17,18,20,28]. The correlation between FCW security and the use of a specific content management system has been introduced in [10], while other studies performed a correlation analysis on website security, such as [13,15,21,22,27]. Taking into consideration the number of studies and the lack of space, we concentrate solely on a subset of relevant studies to this work and their results.…”

“…Goethem et al [15] presents a large-scale security analysis of 22,851 websites originating in 28 European countries. Furthermore, Raponi and Di Pietro [27] analyzed the password recovery management mechanism of Alexa's top 200 websites, with domains registered in certain European countries. They found that more than 54% of the websites in France, 36% in Italy, 47% in Spain, and 33% in the UK were vulnerable in December 2017.…”

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

“…However, they come with many security problems: Users tend to choose easily guessable passwords and re-use them for multiple accounts [18,69,87,89,90], or suffer from insecure or hard-to-use password policies [35,52,84]. Additionally, service providers may implement insecure and inadequate password storage, leaving millions of passwords unprotected due to data breaches [17,29,32,70,72,95]. Multi-Factor Authentication (MFA) adds an extra factor and additional security to passwordbased authentication schemes, and has become important in many authentication deployments on the web.…”

Is My Password Strong Enough?: A Study on User Perception in The Developing World

“…Password-based authentication is in use for a long time and the popular among wide user bases. However, as we are meeting rapid adoption of new technologies such as cloud applications, social networking sites, we often need to remember quite a few usernames and passwords daily, which is not always easy [2]. A recent study revealed that on average, a user maintains 25 online accounts [3].…”