The Emperor’s New Password Manager - Security Analysis of Web-based Password Managers

Explore a comprehensive security analysis of web-based password managers in this conference talk from OWASP AppSec California 2015. Delve into four key security concerns identified through case studies of five popular web-based password managers. Discover severe vulnerabilities that could allow attackers to access user credentials for arbitrary websites. Examine issues in features like one-time passwords, bookmarklets, and shared passwords, stemming from logic errors, authorization mistakes, and misunderstandings of web security models. Learn about the challenges of securing password managers and gain insights into defense-in-depth strategies for future development. Understand the importance of addressing diverse vulnerabilities, including CSRF and XSS, to enhance the security of these critical tools.

Intro
Passwords are horrible
Password managers
Security
Webbased Password Managers
Bookmarklet vulnerabilities
Password database vulnerability
Authorization vulnerability
Phishing
Mitigations