Look Who it Was Random video

The Emperor’s New Password Manager - Devdatta Akhawe - OWASP AppSec California 2015

514 views · Published 29 April 2015 · 23:56 · Indexed 12 November 2026

Channel: OWASP Foundation · 2015 · Science & Technology

Watch on YouTube

AppSec California 2015 - Day 1, Track 2, Slot 2

Title

The Emperor’s New Password Manager: Security Analysis of Web-based Password Managers

Abstract

Joint work with Zhiwei Li, Warren He, Dawn Song.

We conduct a security analysis of five popular web-based password managers. Unlike “local” password managers, web-based password managers run in the browser. We identify four key security concerns for web-based password managers and, for each, identify representative vulnerabilities through our case studies. Our attacks are severe: in four out of the five password managers we studied, an attacker can learn a user’s credentials for arbitrary websites. We find vulnerabilities in diverse features like one-time passwords, bookmarklets, and shared passwords. The root-causes of the vulnerabilities are also diverse: ranging from logic and authorization mistakes to misunderstandings about the web security model, in addition to the typical vulnerabilities like CSRF and XSS. Our study suggests that it remains to be a challenge for the password managers to be secure. To guide future development of password managers, we provide guidance for password managers. Given the diversity of vulnerabilities we identified, we advocate a defense-in-depth approach to ensure security of password managers.

Bio

Dev is a security engineer at Dropbox. Previously, he was a grad student at UC Berkeley interested in web application security. His research focuses on web application security, browser security, and other related topics. He is also an editor of the Sub Resource Integrity spec and is always happy to talk about Content Security Policy.

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

More from this channel