Passwords Are Meant to Be Secret: A Practical Secure Password Entry Channel for Web Browsers

Password-based authentication faces various security and usability issues. Password managers help alleviate some of these issues by enabling users to manage their passwords effectively. However, malicious client-side scripts and browser extensions can steal passwords after they have been autofilled by the manager into the web page. In this paper, we explore what role the password manager can take in preventing the theft of autofilled credentials without requiring a change to user behavior. To this end, we identify a threat model …

authentication browser browser extensions browsers can channel client client-side cs.cr effectively entry extensions malicious manage manager managers password password managers passwords scripts secret security steal the web usability web web browsers