Skip to main content

Forensically-sound Analysis of Security Risks of Using Local Password Managers

Gray, Joshua and Franqueira, Virginia N.L. and Yu, Yijun (2017) Forensically-sound Analysis of Security Risks of Using Local Password Managers. In: 2016 IEEE 24th International Requirements Engineering Conference Workshops (REW). IEEE, pp. 114-121. ISBN 978-1-5090-3694-3. E-ISBN 978-1-5090-3694-3. (doi:10.1109/REW.2016.034)

PDF - Author's Accepted Manuscript
Download (446kB) Preview
[img]
Preview
PDF - Publisher pdf
Restricted to Repository staff only
Contact us about this Publication Download (519kB)
[img]
Official URL
https://dx.doi.org/10.1109/REW.2016.034

Abstract

Password managers address the usability challenge of authentication, i.e., to manage the effort in creating, memorising, and entering complex passwords for an end-user. Offering features such as creating strong passwords, managing increasing number of complex passwords, and auto-filling of passwords for variable contexts, their security is as critical as the assets being protected by the passwords. Previous security risk analyses have focused primarily on cloud- and browser-based password managers, whilst the security risks of local password managers were left under-explored. Taking a systematic forensic analysis approach, this paper reports on a case study of three popular local password managers: KeePass (v2.28), Password Safe (v3.35.1) and RoboForm (v7.9.12). It revealed risks that either the master password or the content of the password database could be found unencrypted in Temp folders, Page files or Recycle bin, even after applications had been closed. As a consequence, an attacker or a malware with access to the computer on which the password managers were running may be able to steal sensitive information, even though these password managers are meant to keep the databases encrypted and protected at all times. These findings point to directions to mitigate the identified risks.

Item Type: Book section
DOI/Identification number: 10.1109/REW.2016.034
Uncontrolled keywords: Password Managers; Authentication; Security Risk; Digital Forensics.
Divisions: Faculties > Sciences > School of Computing > Security Group
Depositing User: Virginia Nunes Leal Franqueira
Date Deposited: 15 Oct 2019 17:56 UTC
Last Modified: 17 Oct 2019 15:25 UTC
Resource URI: https://kar.kent.ac.uk/id/eprint/77179 (The current URI for this page, for reference purposes)
Franqueira, Virginia N.L.: https://orcid.org/0000-0003-1332-9115
  • Depositors only (login required):

Downloads

Downloads per month over past year