CredProxy: A Password Manager for Online Authentication Environments

Internet users are increasingly required to sign up for online services and establish accounts before receiving service from websites. On the one hand, generation of strong usernames and passwords is a difficult task for the user. On the other hand, memorization of strong passwords is by far more problematic for the average user. Thus, the average user has a tendency to use weak passwords, and also reuse his passwords for more than one website, which makes several attacks feasible. Under the aforementioned circumstances, the use of password managers is beneficial, since they unburden the user from the task of memorizing user credentials. However, password managers have a number of weaknesses. This thesis is mainly aimed at alleviating some of the intrinsic weaknesses of password managers. We propose three cryptographic protocols which can improve the security of password managers while enhancing user convenience. We also present the design of a phishing and Man-in-the-Browser resistant password manger which best fits into our scheme. Furthermore, we present our novel virtual on-screen keyboard and keypad which are designed to provide strong protection mechanisms against threats such as keylogging and shoulder surfing.

Name thesis:degree_name

MSc

Level thesis:degree_level

Masters

Discipline thesis:degree_discipline

Génie / Engineering

Grantor dc:publisher

Université d'Ottawa / University of Ottawa

Year dc:date.issued

2013

Author dc:creator

• Golrang, Mohammad Saleh

Advisor dc:contributor.supervisor

• Adams, Carlisle

• Dictionary Attacks
• Password Managers
• Password Security
• Website User Authentication
• Virtual Keyboards
• MITB Attacks

Language dc:language.iso

en

Identifier URI

http://dx.doi.org/10.20381/ruor-6391

Identifier

http://dx.doi.org/10.20381/ruor-6391

OAI record oai:identifier

https://ruor.uottawa.ca/server/oai/request?verb=GetRecord&metadataPrefix=dim&identifier=oai%3Aruor.uottawa.ca%3A10393%2F23611