Annual Computer Security Applications Conference (ACSAC) 2012

Full Program »

Tapas: Design, Implementation, and Usability Evaluation of a Password Manager

Paper
View File
pdf
983KB

Daniel McCarney
Carleton University
Canada

David Barrera
Carleton University
Canada

Jeremy Clark
Carleton University
Canada

Sonia Chiasson
Carleton University
Canada

Paul van Oorschot
Carleton University
Canada

Abstract:
Passwords continue to prevail on the web as the primary method for user authentication despite their well-known security and usability drawbacks. Password managers offer some improvement without requiring server-side changes. In this paper we present the design and security evaluation of dual possession authentication, an authentication approach offering encrypted storage of passwords and theft-resistance without the use of a master password. We further introduce Tapas, a concrete implementation of dual-possession authentication leveraging a desktop computer and a smartphone. Tapas requires no server-side changes to websites, no master password, and protects all the stored passwords in the event either the primary or secondary device (e.g., computer or phone) is stolen. To evaluate the viability of Tapas as an alternative to traditional password managers, we perform a 30 participant user study comparing Tapas to two configurations of Firefox's built-in password manager. We found users significantly preferred Tapas. We further improve Tapas by incorporating feedback from this study, and reevaluate it with an additional 10 participants.

 

Powered by OpenConf®
Copyright ©2002-2012 Zakon Group LLC