Embed Size (px)
DESCRIPTION
During the recent years, smartphones and tablets have become a fixture of daily life. They are used to run ever more tasks and services. Unfortunately, when it comes to password management, users are confronted with greater security and usability concerns than in the non-mobile world. This work presents a password manager for Android that can accommodate any app. Existing platform mechanisms are leveraged to better protect against malware and device theft, than current solutions. Our approach also provides significant usability improvements. No modifications are required to existing applications or to the mobile platform.
Citation preview
A keyboard that
manages your
passwords in Android
PRISMS 2014
Aalborg, 11-14 May 2014
Faysal Boukayoua
Vincent Naessens
Bart De Decker
KU Leuven
Overview
• Motivation
• Approach
• Implementation
• Other considerations
• Evaluation
• Conclusion
Poor usability
Motivation: passwords
Insecure
Motivation: passwords on mobile devices
Typing
inconvenience “There’s an app for
everything”
Motivation: widely used mobile solutions
Platform-based
account mgmt
Browser pwd
mgmt
Password
vaults
Our
approach
Secure
provisioning?
Yes Yes No Yes
Disruptive to
workflow?
No No Yes No
Support for all
passwords?
No No Yes Yes
Changes to app? Yes No No No
Portable to other
platforms?
Yes, but different
APIs
Yes Yes Currently only
Android
Approach: key concepts
Passwords through
the keyboard Secure password
storage
App authentication User authentication
Approach: architecture
User
MDM server
Relying app 1
Keyboard
Password store
Pa
ssw
ord
ma
na
ge
r
Mobile
devic
e
Relying app 2 Relying app 3
System keystore
Mobile OS
Approach: protocol
User Keyboard Password store
1. Log in
8. Get account
9. Return user name and password
6. Display accounts
7. Select account
10. Prompt to indicate corresponding field
11. Indicate corresponding field
12. Populate field
4. Get account(s) for relying app
5. Return account(s)
3. Request user name and password
2. Prompt for user name and password
Repeat for user name, password
If [multiple accounts]
Relying app
Implementation: prototype
• Google Nexus 4
• Android 4.3
• All components in 1 app package
• Configure in Language and Input
Retrieve user name and
password
Implementation: prototype
• Google Nexus 4
• Android 4.3
• All components in 1 app package
• Configure in Language and Input
Store user name and
password
Implementation: prototype
• Google Nexus 4
• Android 4.3
• All components in 1 app package
• Configure in Language and Input
Generate strong password
(auxiliary)
Implementation: retrieving an account 12
Implementation: retrieving an account 13
Implementation: retrieving an account 14
Implementation: retrieving an account 15
Implementation: retrieving an account 16
Implementation: storing an account
Implementation: storing an account
Implementation: storing an account
Implementation: storing an account
Implementation: storing an account
Implementation: storing an account
Implementation: storing an account
Implementation: storing an account
Implementation: keyboard
Android Input Method Framework (IMF)
• Strict separation between
o client apps
o client apps and editor (IME)
• Only one client active at once
• IME change only by user, not app
• Not just keyboards: voice, handwriting,…
Input Method
Editor
Input Method
Clients
Implementation: password store
• Symmetric encryption
• Protect crypto key using KeyChain
o Android 4.3+: hardware-backed RSA key
storage
o App-level credential access
• Alternative: symmetric key in secure
element
Implementation: user authentication
• System passcode
• Android Device Administration API
o Force enabled passcode
o Strength requirements
o Max inactivity for lock screen
o Others:
• Max failed attempts
• Expiry
• Password history restrictions
• …
Implementation: app authentication
• Access control to app passwords
• Compound app ID
o Package name (e.g. com.skype.raider)
o Developer signature
• Extension: password pooling
o Why?
• Same authentication infrastructure
• Browsers
o How?
• Same signature
• User-composed lists
• …
Other considerations
• Subdivision for website passwords
Android app
∟ Website domain
• Mobile Device Management
o Password policies
o Password pooling between apps
o Require hardware-backed KeyChain
o Application white- / blacklists
• Backups: recovery from loss
• Synchronisation: multi-device access
Evaluation
Platform-based
account mgmt
Browser pwd
mgmt
Password
vaults
Our
approach
Secure
provisioning?
Yes Yes No Yes
Disruptive to
workflow?
No No Yes No
Support for all
passwords?
No No Yes Yes
Changes to app? Yes No No No
Portable to other
platforms?
Yes, but different
APIs
Yes Yes Currently only
Android
Conclusion
• Passwords are:
o here to stay… for now
o more cumbersome on mobile devices
• Contributions
o Interoperability
• No platform or app changes
• Support for all passwords
o Usability: integration in user’s workflow
o Secure provisioning and storage
Q&A
![[DEFCON 16] Bypassing pre-boot authentication passwords by instrumenting the BIOS keyboard buffer (practical low level attacks against x86 pre-boot authentication software)](https://img.pdfslide.net/doc/110x75/55842a3ed8b42a86478b4ef2/defcon-16-bypassing-pre-boot-authentication-passwords-by-instrumenting-the-bios-keyboard-buffer-practical-low-level-attacks-against-x86-pre-boot-authentication-software.jpg)
![D5200 Programmer - AlarmHow.net Programmer/D5200...D5200 Programmer FEATURES w4-Line Liquid Crystal Display wCustom Keyboard [Load, Copy, Navigate] wUp to 8 programmable passwords](https://img.pdfslide.net/doc/110x75/5aaf114b7f8b9a190d8ce28c/d5200-programmer-programmerd5200d5200-programmer-features-w4-line-liquid-crystal.jpg)
