Kamouflage Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen - - PowerPoint PPT Presentation

▶
kamouflage
SMART_READER_LITE
LIVE PREVIEW

Kamouflage Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen - - PowerPoint PPT Presentation

Jun 12, 2023 133 likes •471 views

Kamouflage Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen Stanford University 1 I am aware that what I am about to say is controversial 54 Millions of smartphone sold during the 1Q 2010 Browsers password managers Elie Bursztein,

slide-1
SLIDE 1

Kamouflage

Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen Stanford University

1

slide-2
SLIDE 2

I am aware that what I am about to say is controversial

slide-3
SLIDE 3

54 Millions of smartphone sold during the 1Q 2010

slide-4
SLIDE 4

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Browsers password managers

slide-5
SLIDE 5

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Browsers password managers

slide-6
SLIDE 6

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

User Study on Password Usages

86 people

32% 68%

Male Female

High-school College Graduate PhD/MD 12.5 25 37.5 50 10 20 30 40 19-25 31-35 41-45 50+

Age

slide-7
SLIDE 7

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Do you allows your web browser to remember your password ?

31% 28% 41%

yes some no

slide-8
SLIDE 8

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

What is our Objective ?

Users want to store their passwords

slide-9
SLIDE 9

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Threat Model

  • Prevents offline attacks
  • Forces the attacker to go online
slide-10
SLIDE 10

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Known approaches

slide-11
SLIDE 11

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Known approaches

  • Make the passwords inaccessible
slide-12
SLIDE 12

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Known approaches

  • Make the passwords inaccessible
  • Use a password generator
slide-13
SLIDE 13

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Known approaches

  • Make the passwords inaccessible
  • Use a password generator
  • Have a secure master password
slide-14
SLIDE 14

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Make passwords inaccessible

  • Almost impossible for a large number of passwords
  • Passwords list change and grow overtime
  • Need some form of revocation
  • Even system build around this idea have bugs (e.g

xbox360)

slide-15
SLIDE 15

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Do you use a password generator ?

45% 42% 13%

yes no don’t know what it is

slide-16
SLIDE 16

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Use strong passwords

Does anyone still believe users do that ????

slide-17
SLIDE 17

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

The rockyou database

  • 32 603 388 passwords
  • Disclosed in 2010

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 2250000 4500000 6750000 9000000

Length

slide-18
SLIDE 18

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Most used passwords

slide-19
SLIDE 19

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Embracing the Truth

All known approaches are not working so we can we do ?

slide-20
SLIDE 20

THE PURLOINED LETTER by Edgar Allan Poe (1845)

slide-21
SLIDE 21
slide-22
SLIDE 22

Here

slide-23
SLIDE 23

You can’t perform offline attacks if you don’t know if you are successful

slide-24
SLIDE 24

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Proposed Architecture

Password set 1 Meta data Password set 2 Password set n ... ... URL Forms Usrmames ... password 1 password 2 ... Password M password 1 password 2 ... Password M password 1 password 2 ... Password M password 1 password 2 ... Password M Password storage Data in clear Decoy data encrypted Real data encrypted

slide-25
SLIDE 25

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Dealing with Password Structure

digit: word mixed digit + word word + digit wo + digit + rd digit + word + digit digit + wo + digit wo + digit + rd + digit digit +wo + digit +rd + digit word + word digit + word + word word + word + digit word + digit + word digit + word + word + digit digit + word + digit + word + digit digit + word + digit + word word + digit + word + digit Leet (1337) non-alpha 1750000 3500000 5250000 7000000

Nb Passwords

slide-26
SLIDE 26

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

RockYou Top word

slide-27
SLIDE 27

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Do you reuse password between different web site ?

18% 82%

Yes No

slide-28
SLIDE 28

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Do you use related password ?

33% 67%

Yes No

slide-29
SLIDE 29

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Web Site Policy

Web Site Password Requirement Google at least 8 characters Yahoo! at least 6 characters YouTube at least 8 characters Facebook at least 6 characters Windows Live at least 6 characters MSN at least 6 characters MySpace between 6 and 10 characters, at least 1 digit or punctuation Fidelity between 6 and 12 characters, digits only Bank of America between 8 and 20 characters, ≥ 1 digit and ≥ 1 letter, no $ < > & ^ ! [ ] Wells Fargo between 8 and 10 characters, ≥ 3 of: uppercase, digit, or special characters

slide-30
SLIDE 30

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

How users will know that they have entered the correct password ?

Provide a visual indicator: each set is associated with a visual icon. Correct False False

slide-31
SLIDE 31

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Evaluation

Collection size (number of decoy sets) 103 104 104 Password set size (number of user passwords) 100 100 20 Database size on disk 2MB 20MB 4MB Measured performance (access and update time) < 1 sec 5 sec < 1 sec

slide-32
SLIDE 32

Kamouflage http://ly.tl/p17 Elie Bursztein, Hristo Bojinov, Dan Boneh, Xavier Boyen

Conclusion

  • Hiding in plain sight is promising
  • It is also harder than one might expect