On the design and implementation of a secure online password vault

• Authors: Burkhard Englert;Pritesh Shah
• Venue: Proceedings of the 2009 International Conference on Hybrid Information Technology
• Year: 2009

Many websites and web applications are secured using passwords. This requires internet users to keep track of many different strong passwords. Since passwords are only used when users are online it appears that the most efficient and convenient way to store a users passwords would also be an online application. Many users, however, are rightfully concerned about the security of such an approach. In particular they are worried that their online password account could be hacked or that password transmissions could be intercepted, potentially exposing all their accounts at the same time. In this paper we describe a new tool that we developed called "Online Safe Vault" that allows users to securely store their passwords online. To secure the tool, passwords are always stored encrypted on our Safe Vault Server and are also always transmitted over the network as encrypted passwords. En- and decryption is performed locally on the users machine. At the same time the passwords are never stored in plaintext on the users machine.