Password meters and generators on the web: From large-scale empirical study to getting it right

CODASPY 2015 - Proceedings of the 5th ACM Conference on Data and Application Security and Privacy

Volumn , Issue , 2015, Pages 253-262

  Van Acker, Steven ^a   Hausknecht, Daniel ^b   Joosen, Wouter ^a   Sabelfeld, Andrei ^b  

^a UNIVERSITY OF LEUVEN   (Belgium)

^b CHALMERS UNIVERSITY OF TECHNOLOGY   (Sweden)

Author keywords

Passwords; Sandboxing; Web security

Indexed keywords

WEB SERVICES;

EMPIRICAL STUDIES; PASSWORDS; PERVASIVE TRUSTS; REFERENCE IMPLEMENTATION; SANDBOXING; STATE OF THE ART; USER AUTHENTICATION; WEB SECURITY;

AUTHENTICATION;

EID: 84928107691     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2699026.2699118     Document Type: Conference Paper

References (67)

1. P. Agten, S. Van Acker, Y. Brondsema, P. H. Phung, L. Desmet, and F. Piessens. JSand: Complete client-side sandboxing of third-party JavaScript without browser modifications. In ACSAC, 2012.
2. D. Akhawe, A. Barth, P. E. Lam, J. C. Mitchell, and D. Song. Towards a formal foundation of web security. In CSF, 2010.
3. Aldo Cortesi. mitmproxy. http://mitmproxy.org.
4. Ariya Hidayat. PhantomJS. http://phantomjs.org.
5. Badpass: Password strength indicator. https://addons.mozilla.org/en-US/firefox/addon/badpass/.
6. J. Bonneau, C. Herley, P. C. van Oorschot, and F. Stajano. The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. In S&P, 2012.
7. W. E. Burr, D. F. Dodson, W. T. Polk, and D. L. Evans. Electronic authentication guideline. In NIST Special Publication, 2004.
8. L. S. Clair, L. Johansen, W. Enck, M. Pirretti, P. Traynor, P. McDaniel, and T. Jaeger. Password exhaustion: Predicting the end of password usefulness. In ICISS, 2006.
9. Content security policy 1.0. http://www.w3.org/TR/CSP/.
10. CrackLib. http://cracklib.sourceforge.net/.
11. D. Crockford. ADsafe - making JavaScript safe for advertising. http://adsafe.org/.
12. CryptoJS. https://code.google.com/p/crypto-js/.
13. X. de Carné de Carnavalet and M. Mannan. From very weak to very strong: Analyzing password-strength meters. In NDSS, 2014.
14. P. Eckersley. How unique is your web browser? In PET, 2010.
15. S. Egelman, A. Sotirakopoulos, I. Muslukhov, K. Beznosov, and C. Herley. Does my password go up to eleven?: The impact of password meters on password selection. In SIGCHI, 2013.
16. Google password help. https://accounts.google.com/PasswordHelp.
17. Html - living standard: The iframe element. http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html.
18. L. Ingram and M. Walfish. TreeHouse: JavaScript sandboxes to help web developers help themselves. In USENIX ATC, 2012.
19. Jacaranda. Jacaranda. http://jacaranda.org.
20. C. Jackson and A. Barth. Forcehttps: Protecting high-security web sites from network attacks. In WWW, 2008.
21. C. Jackson and H. J. Wang. Subspace: Secure cross-domain communication for web mashups. In WWW, 2007.
22. T. Jim, N. Swamy, and M. Hicks. Defeating Script Injection Attacks with Browser-Enforced Embedded Policies. In WWW, 2007.
23. P. Kelley, S. Komanduri, M. Mazurek, R. Shay, T. Vidas, L. Bauer, N. Christin, L. Cranor, and J. Lopez. Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. In S&P, 2012.
24. F. D. Keukelaere, S. Bhola, M. Steiner, S. Chari, and S. Yoshihama. Smash: Secure component model for cross-domain mashups on unmodified browsers. In WWW, 2008.
25. D. V. Klein. Foiling the cracker: A survey of, and improvements to, password security. USENIX Security, 1990.
26. Leet. http://en.wikipedia.org/wiki/Leet.
27. T. Luo and W. Du. Contego: Capability-based access control for web browsers. In TRUST, 2011.
28. S. Maéis and A. Taly. Language-based isolation of untrusted Javascript. In CSF, 2009.
29. J. Magazinius, P. Phung, and D. Sands. Safe wrappers and sane policies for self protecting JavaScript. In Nordsec, 2010.
30. L. Meyerovich and B. Livshits. ConScript: Specifying and enforcing fine-grained security policies for Javascript in the browser. In S&P, 2010.
31. Create strong passwords. https://www.microsoft. com/security/pc-security/password-checker.aspx.
32. Microsoft Live Labs. Live Labs Websandbox. http://websandbox.org.
33. M. S. Miller, M. Samuel, B. Laurie, I. Awad, and M. Stay. Caja - safe active content in sanitized JavaScript. Technical report, Google Inc., June 2008.
34. R. Morris and K. Thompson. Password security - a case history. Commun. ACM, 22(11):594-597, 1979.
35. Mozilla. Use bookmarklets to quickly perform common web page tasks. https://support.mozilla.org/en-US/kb/bookmarklets-perform-common-web-page-tasks.
36. N. Nikiforakis, L. Invernizzi, A. Kapravelos, S. Van Acker, W. Joosen, C. Kruegel, F. Piessens, and G. Vigna. You are what you include: Large-scale evaluation of remote javascript inclusions. In CCS, 2012.
37. P. Oechslin. Making a faster cryptanalytic time-memory trade-off. In CRYPTO, 2003.
38. Openwall. John the ripper password cracker. http://www.openwall.com/john/.
39. OWASP. HTML5 Security Cheat Sheet. https://www. owasp.org/index.php/HTML5-Security-Cheat-Sheet.
40. OWASP. Password storage cheat sheet. https://www.owasp.org/index.php/Password-Storage-Cheat-Sheet.
41. P. H. Phung, D. Sands, and A. Chudnov. Lightweight self-protecting JavaScript. In ASIACCS, 2009.
42. J. G. Politz, S. A. Eliopoulos, A. Guha, and S. Krishnamurthi. ADsafety: Type-based verification of JavaScript Sandboxing. In USENIX Security, 2011.
43. Html - living standard: Posting messages. http://www.whatwg.org/specs/web-apps/current-work/multipage/web-messaging.html.
44. R. W. Proctor, M.-C. Lien, K.-P. L. Vu, E. E. Schultz, and G. Salvendy. Improving computer security for authentication of users: Inuence of proactive password restrictions. BRMIC, 34(2):163-9, 2002.
45. Swedish Post and Telecommunication Agency. http://www.pts.se/.
46. A million tested passwords. http://www.pts.se/en-GB/News/Press-releases/2012/A-million-tested-passwords/.
47. C. Reis, J. Dunagan, H. J. Wang, O. Dubrovsky, and S. Esmeir. BrowserShield: Vulnerability-driven filtering of dynamic HTML. In OSDI, 2006.
48. M. Research. Telepathwords: Preventing weak passwords by reading your mind. https://telepathwords.research.microsoft.com/.
49. Syrian Electronic Army uses Taboola ad to hack Reuters (again). https://nakedsecurity.sophos.com/2014/06/23/syrian-electronic-army-uses-taboola-ad-to-hack -reuters-again/.
50. J. H. Saltzer and M. D. Schroeder. The protection of information in computer systems. IEEE, 1975.
51. Sharethis. http://www.sharethis.com/.
52. Taboola. https://www.taboola.com/.
53. M. Ter Louw, K. T. Ganesh, and V. Venkatakrishnan. AdJail: Practical Enforcement of Confidentiality and Integrity Policies on Web Advertisements. In USENIX Security, 2010.
54. Test your password (testa lösenord). https://testalosenord.pts.se/.
55. Tynt. http://www.tynt.com/.
56. B. Ur, P. G. Kelley, S. Komanduri, J. Lee, M. Maass, M. L. Mazurek, T. Passaro, R. Shay, T. Vidas, L. Bauer, N. Christin, and L. F. Cranor. How does your password measure up? the effect of strength meters on password creation. In USENIX Security, 2012.
57. S. Van Acker, P. De Ryck, L. Desmet, F. Piessens, and W. Joosen. WebJail: Least-privilege integration of third-party components in web mashups. In ACSAC, 2011.
58. S. Van Acker, D. Hausknecht, and A. Sabelfeld. Password meters and generators on the web: From large-scale empirical study to getting it right - full version and code. http://www.cse.chalmers.se/~andrei/SandPass/.
59. Verizon. 2014 data breach investigations report. http://www.verizonenterprise.com/DBIR/2014/.
60. W3C. Cross-Origin Resource Sharing. http://www.w3.org/TR/cors/.
61. W3C. Document Object Model Core - textContent. http://www.w3.org/TR/DOM-Level-3-Core/core. html#Node3-textContent.
62. W3C. W3C Standards and drafts - JavaScript APIs. http://www.w3.org/TR/#tr-JavaScript-APIs.
63. Web Cryptography API. http://www.w3.org/TR/WebCryptoAPI/.
64. M. Weir, S. Aggarwal, M. P. Collins, and H. Stern. Testing metrics for password creation policies by attacking large sets of revealed passwords. In CCS, 2010.
65. J. J. Yan, A. F. Blackwell, R. J. Anderson, and A. Grant. Password memorability and security: Empirical results. S&P, 2004.
66. S. Zarandioon, D. Yao, and V. Ganapathy. Omos: A framework for secure communication in mashup applications. In ACSAC, 2008.
67. zxcvbn: Realistic password strength estimation. https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/.