SplitPass： A Mutually Distrusting Two-Party Password Manager

Using a password manager is known to be more convenient and secure than not using one, on the assmnption that the password manager itself is safe. However recent studies show that most popular password managers have security vulnerabilities that may be fooled to leak passwords without users＇ awareness. In this paper, we propose a new password manager, SplitPass, which vertically separates both the storage and access of passwords into two mutually distrusting parties. During login, all the parties will collaborate to send their password shares to the web server, but none of these parties will ever have the complete password, which significantly raises the bar of a successful attack to compromise all of tile parties. To retain transparency to existing applications and web servers, SplitPass seamlessly splits the secure sockets layer （SSL） and transport layer security （TCP） sessions to process on all parties, and makes the joining of two password shares transparent to the web servers. We have implemented SplitPass using an Android phone and a cloud assistant and evaluated it using 100 apps from top free apps in the Android official market. The evaluation shows that SplitPass securely protects users＇ passwords, while incurring little performance overhead and power consumption.

Implementation of a TPM-Based Security Enhanced Browser Password Manager

In order to enhance the security of a browser password manager, we propose an approach based on a hardware trusted platform module （TPM）. Our approach encrypts users＇ passwords with keys generated by the TPM, which uses a master password as the credential for authorization to access the TPM. Such a hardware-based feature may provide an efficient way to protect users＇ passwords. Experiment and evaluation results show that our approach performs well to defend against password stealing attack and brute force attack. Attackers cannot get passwords directly from the browser, therefore they will spend incredible time to obtain passwords. Besides, performance cost induced by our approach is acceptable.Abstract： In order to enhance the security of a browser password manager, we propose an approach based on a hardware trusted platform module （TPM）. Our approach encrypts users＇ passwords with keys generated by the TPM, which uses a master password as the credential for authorization to access the TPM. Such a hardware-based feature may provide an efficient way to protect users＇ passwords. Experiment and evaluation results show that our approach performs well to defend against password stealing attack and brute force attack. Attackers cannot get passwords directly from the browser, therefore they will spend incredible time to obtain passwords. Besides, performance cost induced by our approach is acceptable.

Introducing CHIPDRIVE MyKey: Computer Lock and Password Manager on a Smart Card-Secured USB Stick

Santa Ana, Calif., March 30, 2010-Having trouble remembering all your passwords? Safely store your passwords, take them wherever you go, and lock up your computer whenever you leave with

SecureWeb： Protecting Sensitive Information Through the Web Browser Extension with a Security Token

The leakage of sensitive data occurs on a large scale and with increasingly serious impact. It may cause privacy disclosure or even property damage. Password leakage is one of the fundamental reasons for information leakage, and its importance is must be emphasized because users are likely to use the same passwords for different Web application accounts. Existing approaches use a password manager and encrypted Web application to protect passwords and other sensitive data; however, they may be compromised or lack accessibility. The paper presents SecureWeb, which is a secure, practical, and user-controllable framework for mitigating the leakage of sensitive data. SecureWeb protects users＇ passwords and aims to provide a unified protection solution to diverse sensitive data. The efficiency of the developed schemes is demonstrated and the results indicate that it has a low overhead and are of practical use.