Password Management Concerns with IE and Firefox, part one


This two part paper presents an analysis of the security mechanisms, risks, attacks, and defenses of the two most commonly used password management systems for web browsers, found in Internet Explorer and Firefox. The article specifically addresses IE 6 and 7 and Firefox 1.5 and 2.0. Attention is devoted to the following areas:

* Password storage mechanisms: The means of safeguarding usernames and passwords on the local file system through encryption (addressed in part 1).
* Attacks on Password Managers: The methods of subverting or bypassing safeguards (partially addressed in part 1; continued in part 2).
* False sense of security: Users employing password managers without any awareness of the risk factors (discussed in part 2).
* Usability: Features that enhance or deter the usability of security features (discussed in part 2).
* Mitigation and Countermeasures: Actions that can be taken by users and corporations to reduce the risk (part 2).

Internet Explorer and Firefox together amass roughly ninety-five percent of all browser market share. [ref 1] AutoComplete [ref 2] and Password Manager [ref 3] are the features that store web form usernames, passwords, and URLs for Internet Explorer (since version 4), and Firefox (since version 0.7), respectively. Password Management Concerns with IE and Firefox, part one

Linked by shanmuga Friday, 8th December 2006 11:42PM