Tapas: design, implementation, and usability evaluation of a password manager

Authors:
Daniel McCarney;David Barrera;Jeremy Clark;Sonia Chiasson;Paul C. van Oorschot
Affiliations:
Carleton University, Ottawa, ON, Canada;Carleton University, Ottawa, ON, Canada;Carleton University, Ottawa, ON, Canada;Carleton University, Ottawa, ON, Canada;Carleton University, Ottawa, ON, Canada
Venue:
Proceedings of the 28th Annual Computer Security Applications Conference
Year:
2012

Citing 19
Cited 0

A convenient method for securely managing passwords

WWW '05 Proceedings of the 14th international conference on World Wide Web
Passpet: convenient password management and phishing protection

SOUPS '06 Proceedings of the second symposium on Usable privacy and security
Password management strategies for online accounts

SOUPS '06 Proceedings of the second symposium on Usable privacy and security
Stronger password authentication using browser extensions

SSYM'05 Proceedings of the 14th conference on USENIX Security Symposium - Volume 14
A usability study and critique of two password managers

USENIX-SS'06 Proceedings of the 15th conference on USENIX Security Symposium - Volume 15
Halting password puzzles: hard-to-break encryption from human-memorable keys

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Digital objects as passwords

HOTSEC'08 Proceedings of the 3rd conference on Hot topics in security
So long, and no thanks for the externalities: the rational rejection of security advice by users

NSPW '09 Proceedings of the 2009 workshop on New security paradigms workshop
Authentication technologies for the blind or visually impaired

HotSec'09 Proceedings of the 4th USENIX conference on Hot topics in security
On pairing constrained wireless devices based on secrecy of auxiliary channels: the case of acoustic eavesdropping

Proceedings of the 17th ACM conference on Computer and communications security
Kamouflage: loss-resistant password management

ESORICS'10 Proceedings of the 15th European conference on Research in computer security
A comparative usability evaluation of traditional password managers

ICISC'10 Proceedings of the 13th international conference on Information security and cryptology
Johnny in internet café: user study and exploration of password autocomplete in web browsers

Proceedings of the 7th ACM workshop on Digital identity management
Phoolproof phishing prevention

FC'06 Proceedings of the 10th international conference on Financial Cryptography and Data Security
Pico: no more passwords!

SP'11 Proceedings of the 19th international conference on Security Protocols
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords

SP '12 Proceedings of the 2012 IEEE Symposium on Security and Privacy
The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes

SP '12 Proceedings of the 2012 IEEE Symposium on Security and Privacy
Graphical passwords: Learning from the first twelve years

ACM Computing Surveys (CSUR)
A Research Agenda Acknowledging the Persistence of Passwords

IEEE Security and Privacy

Quantified Score

Hi-index	0.00

Visualization

Abstract

Passwords continue to prevail on the web as the primary method for user authentication despite their well-known security and usability drawbacks. Password managers offer some improvement without requiring server-side changes. In this paper, we evaluate the security of dual-possession authentication, an authentication approach offering encrypted storage of passwords and theft-resistance without the use of a master password. We further introduce Tapas, a concrete implementation of dual-possession authentication leveraging a desktop computer and a smartphone. Tapas requires no server-side changes to websites, no master password, and protects all the stored passwords in the event either the primary or secondary device (e.g., computer or phone) is stolen. To evaluate the viability of Tapas as an alternative to traditional password managers, we perform a 30 participant user study comparing Tapas to two configurations of Firefox's built-in password manager. We found users significantly preferred Tapas. We then improve Tapas by incorporating feedback from this study, and reevaluate it with an additional 10 participants.