Later archive addition

The Emperor's New Password Manager: Security Analysis of Web-based Password Managers

Zhiwei Li, Warren He, Devdatta Akhawe and Dawn Song

A security analysis of five browser-based password managers, grouping their weaknesses into bookmarklet, web, authorization and user interface flaws. In four of the five, chained mistakes such as CSRF, XSS and broken one-time-password or shared-password logic let an attacker recover a victim's stored credentials for arbitrary sites.

Record

Researcher

Zhiwei Li, Warren He, Devdatta Akhawe and Dawn Song

In the archive

• Added to the 2014 archive after the original list was published

Related sources

• Talk recording

Tags

• auth-bypass
• csrf
• xss
• browser-extension
• same-origin-policy
• info-leak
• case-study
• defence
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Zhiwei Li, Warren He, Devdatta Akhawe and Dawn Song, first published at the original source. Preserved copies are kept so the citation survives its host.