Cherry, Ali, Barmpis, Kostas and Shahandashti, Siamak F. orcid.org/0000-0002-5284-6847 (2024) The Emperor is Now Clothed:A Secure Governance Framework for Web User Authentication through Password Managers. In: Information and Communications Security:26th International Conference, ICICS 2024. International Conference on Information and Communications Security (ICICS 2024), 26-28 Aug 2024 , GRC
Abstract
Existing approaches to facilitate the interaction between password managers and web applications fall short of providing adequate functionality and mitigation strategies against prominent attacks. HTML Autofill is not sufficiently expressive, Credential Management API does not support browser extension password managers, and other proposed solutions do not conform to established user mental models. In this paper, we propose Berytus, a browser-based governance framework that mediates the interaction between password managers and web applications. Two APIs are designed to support Berytus acting as an orchestrator between password managers and web applications. An implementation of the framework in Firefox is developed that fully supports registration and authentication processes. As an orchestrator, Berytus is able to authenticate web applications and facilitate authenticated key exchange between web applications and password managers, which as we show, can provide effective mitigation strategies against phishing, cross-site scripting, inline code injection (e.g., by a malicious browser extension), and TLS proxy in the middle attacks, whereas existing mitigation strategies such as Content Security Policy and credential tokenisation are only partially effective. The framework design also provides desirable functional properties such as support for multi-step, multi-factor, and custom authentication schemes. We provide a comprehensive security and functionality evaluation and discuss possible future directions.
Metadata
Item Type: | Proceedings Paper |
---|---|
Authors/Creators: |
|
Copyright, Publisher and Additional Information: | This is an author-produced version of the published paper. Uploaded in accordance with the University’s Research Publications and Open Access policy. |
Keywords: | Password Managers,Password Manager Security,HTML Autofill,User Authentication,Web Authentication |
Dates: |
|
Institution: | The University of York |
Academic Units: | The University of York > Faculty of Sciences (York) > Computer Science (York) |
Depositing User: | Pure (York) |
Date Deposited: | 10 Jul 2024 10:50 |
Last Modified: | 13 Nov 2024 09:25 |
Status: | Published |
Related URLs: | |
Sustainable Development Goals: | |
Open Archives Initiative ID (OAI ID): | oai:eprints.whiterose.ac.uk:214667 |
Download
Description: CBS24-Berytus-Password-Manager-Governance-Framework
Licence: CC-BY 2.5