Getting web authentication right Joseph Bonneau jcb82@cl.cam.ac.uk - PowerPoint PPT Presentation

Getting web authentication right Joseph Bonneau jcb82@cl.cam.ac.uk Security Protocols Workshop March 28, 2011 J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 1 / 14

A parable of obsolescent technology Credit: freeyellow.com J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 2 / 14

Web authentication has evolved very little... Wall Street Journal, 1996 Wall Street Journal, 2010 J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 3 / 14

Goals for this talk An outline for how secure web-based password authentication can be As secure as possible As simple as possible No new software 1 No change to user experience How secure is this? Why aren’t implementations any where close? 1 But a healthy dose of HTML 5 and other modern tricks J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 4 / 14

Goals for this talk An outline for how secure web-based password authentication can be As secure as possible As simple as possible No new software 1 No change to user experience How secure is this? Why aren’t implementations any where close? 1 But a healthy dose of HTML 5 and other modern tricks J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 4 / 14

Goals for this talk An outline for how secure web-based password authentication can be As secure as possible As simple as possible No new software 1 No change to user experience How secure is this? Why aren’t implementations any where close? 1 But a healthy dose of HTML 5 and other modern tricks J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 4 / 14

How password authentication goes wrong Keyloggers Phishing Persistent login cookies . . . Password recovery questions Password re-use Password database compromise . . . Cookie stealing Password guessing J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 5 / 14

Registration (TLS) Transmitted: y = H Y x = H X ℓ 2 ( u || s ) , ℓ 1 ( u || p || s ) Stored: y = H Y z = H Z ( u || x ) ℓ 2 ( u || s ) , s: site identifier u: username p: password x: “authenticator” J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 6 / 14

Login (TLS) Transmitted: x = H X ℓ 1 ( u || p || s ) u , Verified to exist in-database: H Z ( u || x ) Returned: K u , a = AE K s ( K u , u , x , t , d ) s : site identifier K S : Server master key a : session cookie u : username K u : session key p : password t : expiration date x : “authenticator” d : additional data J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 7 / 14

Site interaction (Plain HTTP) Transmitted as a cookie: a = AE K s ( K u , u , x , t , d ) Appended to requests: AE K u ( data ) s : site identifier K S : Server master key a : session cookie u : username K u : session key p : password t : expiration date x : “authenticator” d : additional data J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 8 / 14

Site interaction (Plain HTTP) Transmitted as a cookie: HTTP-only a = AE K s ( K u , u , x , t , d ) Appended to requests: AE K u ( data ) s : site identifier K S : Server master key a : session cookie u : username K u : session key p : password t : expiration date x : “authenticator” d : additional data J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 8 / 14

Site interaction (Plain HTTP) Transmitted as a cookie: HTTP-only a = AE K s ( K u , u , x , t , d ) Appended to requests: JavaScript & HTML5 localStorage AE K u ( data ) s : site identifier K S : Server master key a : session cookie u : username K u : session key p : password t : expiration date x : “authenticator” d : additional data J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 8 / 14

Site interaction (Plain HTTP) Transmitted as a cookie: HTTP-only a = AE K s ( K u , u , x , t , d ) Optional cookie: HTTP-only, SECURE a secure = AE K s ( K u , u , x , t 2 > t , d ) Appended to requests: JavaScript & HTML5 localStorage AE K u ( data ) s : site identifier K S : Server master key a : session cookie u : username K u : session key p : password t : expiration date x : “authenticator” d : additional data J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 8 / 14

Server verification Verify & decrypt a = AE K s ( K u , u , x , t , d ) Verify & decrypt AE K u ( data ) Verify that z = H Z ( u || x ) is stored (optional) Check timestamp t ≥ now Check ACL for u , d , data s : site identifier K S : Server master key a : session cookie u : username K u : session key p : password t : expiration date x : “authenticator” d : additional data J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 9 / 14

Server verification Verify & decrypt a = AE K s ( K u , u , x , t , d ) Verify & decrypt AE K u ( data ) Verify that z = H Z ( u || x ) is stored (optional) Check timestamp t ≥ now Check ACL for u , d , data s : site identifier K S : Server master key a : session cookie u : username K u : session key p : password t : expiration date x : “authenticator” d : additional data J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 9 / 14

Performance analysis Login Server 1 hash 1 DB lookup 1 AE + 1 RNG Browser 1 iterated hash ( ≤ 0.1 s, PC; ∼ 1 s, mobile) Interaction Server 2 AE 1 DB lookup (optional) Browser 2 AE ( ≤ 10 ms, PC; ≤ 0.1 s, mobile) J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 10 / 14

Security analysis-many attacks prevented rainbow tables online password guessing cookie modification . . . session key theft (XSS) session cookie theft (sidejacking) read-only DB access user probing . . . XSS + sidejacking DB access + cookie theft malware in browser password theft phishing persistent log-in J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 11 / 14

Security analysis-many attacks prevented rainbow tables online password guessing cookie modification . . . session key theft (XSS) session cookie theft (sidejacking) read-only DB access user probing . . . XSS + sidejacking DB access + cookie theft malware in browser password theft phishing persistent log-in J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 11 / 14

Security analysis-many attacks prevented rainbow tables online password guessing cookie modification . . . session key theft (XSS) session cookie theft (sidejacking) read-only DB access user probing . . . XSS + sidejacking DB access + cookie theft malware in browser password theft phishing persistent log-in J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 11 / 14

Some sobering facts Over 90% of the top 500 websites collect passwords 29-50% store them in the clear 84% do not prevent brute force attacks at all 40% implement TLS correctly (20% incorrectly, 40% not at all) hashing in browser, HTTP-only cookies extremely rare... J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 12 / 14

Even the frameworks get it wrong! J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 13 / 14

Is it worthwhile to fix password authentication? jcb82@cl.cam.ac.uk J. Bonneau (U. of Cambridge) Getting web authentication right March 28, 2011 14 / 14