Passpet: convenient password management and phishing protection

ABSTRACT

We describe Passpet, a tool that improves both the convenience and security of website logins through a combination of techniques. Password hashing helps users manage multiple accounts by turning a single memorized password into a different password for each account. User-assigned site labels (petnames) help users securely identify sites in the face of determined attempts at impersonation (phishing). Password-strengthening measures defend against dictionary attacks. Customizing the user interface defends against user-interface spoofing attacks. We propose new improvements to these techniques, discuss how they are integrated into a single tool, and compare Passpet to other solutions for managing passwords and preventing phishing.

REFERENCES

• 1: M. Abadi, T. M. A. Lomas, and R. Needham. Strengthening Passwords. Technical Report 1997-033, SRC, 2005.
• 2: T. Close. Petname Tool. http://petname.mozdev.org/.
• 3: CoreStreet. Spoofstick. http://www.spoofstick.com/.
• 4: Rachna Dhamija , J. D. Tygar, The battle against phishing: Dynamic Security Skins, Proceedings of the 2005 symposium on Usable privacy and security, p.77-88, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073009]
• 5: Rachna Dhamija , J. D. Tygar , Marti Hearst, Why phishing works, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124861]
• 6: Earthlink. Earthlink Toolbar and ScamBlocker FAQ. http://kb.earthlink.net/case.asp?article=30492.
• 7: Earthlink. Earthlink Toolbar Featuring ScamBlocker for Windows Users. http://www.earthlink.net/software/free/toolbar/.
• 8: S. Fox, L. Rainie, J. Horrigan, A. Lenhart, T. Spooner, and C. Carter. Trust and privacy online: Why Americans want to rewrite the rules. August 2000. http://www.pewinternet.org/report_display.asp?r=19.
• 9: R. Franco. Better Website Identification and Extended Validation Certificates in IE7 and Other Browsers. November 2005. http://blogs.msdn.com/ie/archive/2005/11/21/495507.aspx.
• 10: Eran Gabber , Phillip B. Gibbons , Yossi Matias , Alain J. Mayer, How to Make Personalized Web Browising Simple, Secure, and Anonymous, Proceedings of the First International Conference on Financial Cryptography, p.17-32, February 24-28, 1997
• 11: Evgeniy Gabrilovich , Alex Gontmakher, The homograph attack, Communications of the ACM, v.45 n.2, February 2002 [doi>10.1145/503124.503156]
• 12: J. Alex Halderman , Brent Waters , Edward W. Felten, A convenient method for securely managing passwords, Proceedings of the 14th international conference on World Wide Web, May 10-14, 2005, Chiba, Japan [doi>10.1145/1060745.1060815]
• 13: A. Herzberg and A. Gbara. TrustBar: Protecting (even Naïve) Web Users from Spoofing and Phishing Attacks. Cryptology ePrint Archive, Report 2004/155, 2004. http://www.cs.biu.ac.il/~herzbea/TrustBar/.
• 14: A. Karp. Site-Specific Passwords. Technical report, HP Labs. http://www.hpl.hp.com/personal/Alan_Karp/site_password/.
• 15: John Kelsey , Bruce Schneier , Chris Hall , David Wagner, Secure Applications of Low-Entropy Keys, Proceedings of the First International Workshop on Information Security, p.121-134, September 17-19, 1997
• 16: R. Naraine. Microsoft Downgrades Claria Adware Detections. July 2005. http://www.eweek.com/article2/0,1895,1834607,00.asp.
• 17: Netcraft. Netcraft Anti-Phishing Toolbar. http://toolbar.netcraft.com/.
• 18: Netcraft. Netcraft Toolbar Privacy Policy. http://toolbar.netcraft.com/privacypolicy.html.
• 19: Bank of America. Sign up for the SiteKey Service. http://www.bankofamerica.com/privacy/passmark/.
• 20: B. Ross, C. Jackson, N. Miyake, D. Boneh, and J. C. Mitchell. Stronger Password Authentication Using Browser Extensions. In Proc. 14th Usenix Security, 2005.
• 21: T. Sharif. Phishing Filter in IE7. September 2005. http://blogs.msdn.com/ie/archive/2005/09/09/463204.aspx.
• 22: M. Stiegler. An Introduction to Petname Systems. http://www.skyhunter.com/marcs/petnames/IntroPetNames.html.
• 23: Protocom Development Systems. Global Password Usage Survey. September 2003. http://www.protocom.com/html/whitepapers/biz_password_survey.html.
• 24: T. Wu. The Secure Remote Password Protocol. In Proc. 1998 Internet Society Network and Distributed System Security Symposium, pages 97--111, March 1998.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.5 On-line Information Services
          Subjects: Web-based services
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications
          Subjects: Information browsers
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Graphical user interfaces (GUI)