The Emperor's New Password Manager: Security Analysis of Web-based Password Managers

Abstract

Synthesis is the problem of obtaining programs from relational specifications. We present grammar-modular (GM) synthesis, an algorithm for synthesis from tree-structured relational specifications. GM synthesis makes synthesis applicable to previously intractable relational specifications by decomposing them into smaller subproblems, which can be tackled in isolation by off-the-shelf synthesis procedures. The program fragments thus generated are subsequently composed to form a program satisfying the overall specification. We also generalize our technique to tree languages of relational specifications. Here, we synthesize a single program capable satisfying any (tree-shaped) relation belonging to the language; the synthesized program is syntax-directed by the structure of the relation. We evaluate our work by applying GM synthesis to document layout: given the semantics of a layout language, we synthesize tailored constraint solvers capable of laying out languages of documents. Our experiments show that GM synthesis is sufficiently complete to successfully generate solvers for non-trivial data visualizations, and that our synthesized solvers are between 39-to 200-times faster than general-purpose constraint solvers.

Comparing Password Management Software: Toward Usable and Secure Enterprise Authentication

“…In regard to the latter scenario, there are some future research lines that would boost the adoption of PMs, namely: investigation on how to automatically integrate and enforce company security policies with PMs; combination with SSO technologies highly used inside corporate environments, such as SAML and OAuth; and research on usability improvements by merging implicit authentication with PMs as mechanisms for substituting the Mast er Key. Finally, as future work we would like to develop automatic testing tools that evaluate the security of PMs empirically in order to complement the theoretical analysis given in this paper and cover specific attack scenarios and vulnerabilities as described in [11] .…”

Forensically-Sound Analysis of Security Risks of Using Local Password Managers

“…These extensions allow the password manager to auto login and auto-populate authentication details to reduce the chances of attacks that involve user participation [9].…”

“…Li et al [9] analysed the security of five cloud-based password managers focusing on protocols used for authentication to a Web application, sharing of passwords with collaborators, encryption and login bookmarklets. They found vulnerabilities related to authorisation, user interface, bookmarklets, and susceptibility to cross-site request forgery and cross-site scripting (XSS) attacks.…”

“…Therefore, it is no surprise that the password managers are becoming one of the best practices among individuals and Small and Medium Enterprises (SMEs) [8]. However, password managers only fulfil their purpose if they are secure; otherwise, they represent a single point of failure [9], exposing users to security vulnerabilities.…”

Evaluation of Professional Cloud Password Management Tools

“…A bookmarklet is a bookmark, which essentially contains JavaScript code, in order to add previously unobtainable features, in a browser. While this on the surface seems like a nifty feature, work in [12] discusses an attack on LastPass, exploiting the users bookmarklet, to gain access to virtually all of the users stored credentials. Finally, it is work mentioning that there has been a recent leak from LastPass [25], that leads to even more users to look suspicious of their services.…”