MFDPG: Multi-Factor Authenticated Password Management With Zero Stored Secrets

2023/06/26 by Nair, Vivek, Song, Dawn · 1 citation
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · doi:10.48550/arxiv.2306.14746

Abstract

While password managers are a vital tool for internet security, they can also create a massive central point of failure, as evidenced by several major recent data breaches. For over 20 years, deterministic password generators (DPGs) have been proposed, and largely rejected, as a viable alternative to password management tools. In this paper, we survey 45 existing DPGs to asses the main security, privacy, and usability issues hindering their adoption. We then present a new multi-factor deterministic password generator (MFDPG) design that aims to address these shortcomings. The result not only achieves strong, practical password management with zero credential storage, but also effectively serves as a progressive client-side upgrade of weak password-only websites to strong multi-factor authentication.

Cited by

• Wrangling Entropy: Next-Generation Multi-Factor Key Derivation, Credential Hashing, and Credential Generation Functions

Related

• That Was Then, This Is Now: A Security Evaluation of Password Generation, Storage, and Autofill in Thirteen Password Managers
• Password Generators: Old Ideas and New
• Secure Password Generator Based on Secure Pseudo-Random Number Generator
• Human-Usable Password Schemas: Beyond Information-Theoretic Security
• Trenchcoat: Human-Computable Hashing Algorithms for Password Generation