Feb. 12, 2024, 5:10 a.m. | Anuj Gautam Tarun Kumar Yadav Kent Seamons Scott Ruoti

cs.CR updates on arXiv.org arxiv.org

Password-based authentication faces various security and usability issues. Password managers help alleviate some of these issues by enabling users to manage their passwords effectively. However, malicious client-side scripts and browser extensions can steal passwords after they have been autofilled by the manager into the web page. In this paper, we explore what role the password manager can take in preventing the theft of autofilled credentials without requiring a change to user behavior. To this end, we identify a threat model …

authentication browser browser extensions browsers can channel client client-side cs.cr effectively entry extensions malicious manage manager managers password password managers passwords scripts secret security steal the web usability web web browsers

Humbly Confident Security Lead

@ YNAB | Remote

Information Technology Specialist II: Information Security Engineer

@ WBCP, Inc. | Pasadena, CA.

Director of the Air Force Cyber Technical Center of Excellence (CyTCoE)

@ Air Force Institute of Technology | Dayton, OH, USA

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Cybersecurity Subject Matter Expert

@ QinetiQ US | Washington, DC, United States

Program Cybersecurity Manage (F/M/X)

@ Alstom | Villeurbanne, FR