Password managers: attacks and defenses
David Lawrence Silver, Suman Jana, Dan Boneh, Eric Chen, Collin Jackson · 2014
We study the security of popular password managers and their policies on automatically filling in Web passwords. We examine browser built-in password managers, mo-bile password managers, and 3rd party managers. We observe significant differences in autofill policies among password managers. Several autofill policies can lead to disastrous consequences where a remote network at-tacker can extract multiple passwords from the user’s password manager without any interaction with the user. We experiment with these attacks and with techniques to enhance the security of password managers. We show that our enhancements can be adopted by existing man-agers. 1