Toward Secure and Convenient Browsing Data Management in the Cloud
summary
The paper measures five popular browsers and finds weak or absent password protection, inconsistent sync, and unencrypted cookies, then proposes a Cloud-Age Browser (CAB) architecture that keeps no browsing data on disk, derives keys with PBKDF2 from a mandatory master password held only in memory, uses authenticated encryption, splits ciphertext with k-of-n secret sharing across multiple cloud storage providers, and intends a wrapper app plus shared library so existing browsers need no code change. Assumes short-lived malware and gives no full deployed implementation yet.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:22Browsing Data Types
- 1:45Ideal Situation
- 3:05Reality
- 12:28Threat Model
- 15:13Assumptions
- 18:45Requirements
- 22:16Architecture
- 24:40Security
- 28:02Consistency
- 28:58Data Structure
- 30:21List Privilege
- 31:45Adoption
- 32:57Conclusion
related talks
34mBreaching the Perimeter via Cloud Synchronized Browser Settings
34mEncrypting Data in the Browser - Exploring Web Crypto APIs
23mKeeping secrets with JavaScript
47mThe state of passwordless auth on the web
18mEffective password management
42mThe Perilous Future of Browser Security
27mA privacy first period tracker? Is it even possible?
42mPasswords are so 1990!