The Emperor’s New Password Manager
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 12:00· Annenberg Community Beach House: Track 2, 415 Pacific Coast Hwy·
summary
Analyzes five real web‑based password managers and demonstrates practical exploits: four out of five leak credentials under attack, with concrete case studies on bookmarklet attacks, CSRF/XSS one‑time‑password abuse, and sharing/authorization logic bugs. Shows which features leak metadata versus encrypted secrets, how exploits are constructed and why client‑side encryption sometimes mitigates but doesn’t solve offline cracking, and offers concrete mitigations (iframes, postMessage target origins, CSP, header CSRF). Watch if concrete vulnerabilities and fixes matter.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:28Passwords are horrible
- 1:02Password managers
- 2:29Security
- 3:24Webbased Password Managers
- 5:37Bookmarklet vulnerabilities
- 11:53Password database vulnerability
- 12:23Authorization vulnerability
- 15:37Phishing
- 18:42Mitigations
related talks
40m"It Me": Under the Hood of Web Authentication
47mThe state of passwordless auth on the web
55mBreaking and Fixing Web Application Security
57mSomething Something Security
43mAttacking Modern Web Technologies
55mSession Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers
44mDraining Your Credentials From Popular MacOS Password Managers
28mLearning from High Profile Failures