Language Selection

English French German Italian Portuguese Spanish

Password Management Concerns with IE and Firefox

Filed under
Security

This two-part paper presents an analysis of the security mechanisms, risks, attacks, and defenses of the two most commonly used password management systems for web browsers, found in Internet Explorer and Firefox. The article specifically addresses IE 6 and 7 and Firefox 1.5 and 2.0. Attention is devoted to the following areas:

  • Password storage mechanisms: The means of safeguarding usernames and passwords on the local file system through encryption (addressed in part 1).

  • Attacks on Password Managers: The methods of subverting or bypassing safeguards (partially addressed in part 1; continued in part 2).
  • False sense of security: Users employing password managers without any awareness of the risk factors (discussed in part 2).
  • Usability: Features that enhance or deter the usability of security features (discussed in part 2).
  • Mitigation and Countermeasures: Actions that can be taken by users and corporations to reduce the risk (part 2).

Internet Explorer and Firefox together amass roughly ninety-five percent of all browser market share. [ref 1] AutoComplete [ref 2] and Password Manager [ref 3] are the features that store web form usernames, passwords, and URLs for Internet Explorer (since version 4), and Firefox (since version 0.7), respectively.

Each browser has helpful features to aid the user from being tasked with remembering different usernames and passwords as a means of authentication for web sites. Thus when navigating to a URL such as http://www.gmail.com where form input fields are present, both IE and Firefox will prompt the user if he or she wants to save their username and password. When the user re-visits the same web site the browser will automatically fill the fields.

Although these features greatly simplify the responsibility of the user, they also introduce security considerations that are addressed in the next few sections.

Part One
Part Two

More in Tux Machines

Linux tutorial website

Hi guys, here you have a website that covers Linux basics: http://linux-bible.com. Most of the examples are from Ubuntu.

Today in Techrights

Edubuntu Vs UberStudent: Return To College With The Best Linux Distro

Importantly, there are a handful of programs that are on Edubuntu that UberStudent doesn’t have, such as KAlgebra, Kazium, KGeography, and Marble. Instead, UberStudent has a smaller collection of applications but it does include some useful items when it comes to writing papers that Edubuntu does not have. So ultimately, Edubuntu includes more programs that are information-heavy, while UberStudent includes more tools that can aid students in their studies but doesn’t directly give them any sort of information. Read more

Zotac Nvidia Jetson TK1 review

The Jetson TK1, Nvidia’s first development board to be marketed at the general public, has taken a circuitous route to our shores. Unveiled at the company’s Graphics Technology Conference earlier this year, the board launched in the US at a headline-grabbing price of $192 but its international release was hampered by export regulations. Zotac, already an Nvidia partner for its graphics hardware, volunteered to sort things out and has partnered with Maplin to bring the board to the UK. In doing so, however, the price has become a little muddled. $192 – a clever dollar per GPU core – has become £199.99. Compared to Maplin’s other single-board computer, the sub-£30 Raspberry Pi, it’s a high-end item that could find itself priced out of the reach of the company’s usual customers. Read more