Protecting user secrets in hostile environments
File(s)
Author(s)
Almasi, Sirvan
Type
Thesis
Abstract
User secrets, such as passwords, personally identifiable information, and financial data, are increasingly vulnerable to browser-based malware, data breaches, and password guessing attacks. Motivated by an increase in cyber crime, this dissertation explores the life cycle of these user secrets and introduces novel methods to mitigate and circumvent security threats. We examine the journey of user secrets through three stages: password composition, client-side interaction, and server-side storage.
We make three contributions with the ultimate aim of protecting user secrets on the web. Firstly, during the password composition phase, we investigate the entropy and resilience of user-generated passwords. Despite their vulnerability to exploits and inherent weaknesses that lead to many data breaches, password-based authentication systems remain prevalent. Motivated by the lack of consensus on password composition policy and strength, we ask if there exists a secure, human-chosen, and memorable password. To address this, we introduce the first-ever human-labelled password dataset and utilise Large Language Models to expedite the labelling process.
Secondly, in the client-side stage, we examine the threats associated with the transmission and handling of user secrets within the browser environment. We design and implement an out-of-band method, FormL3SS, to circumvent Man-in-the-Browser malware.
Finally, we focus on the server-side security phase---the final stage in the journey of user secrets. We explore whether identity-based cryptosystems can replace traditional hash functions for password-based authentication. Using these cryptosystems, we design and implement a password-less protocol---deeID.
It is clear that modern web authentication, dominated by password, and its trajectory of progress is unsustainable. The current stopgap approach of bolstering password weaknesses through additional layers, such as MFA, has resulted in user frustration and, paradoxically, in many cases introduced new vulnerabilities. We hope that our work will inspire a paradigm shift and encourage a bold leap towards new passwordless and usable authentication systems.
We make three contributions with the ultimate aim of protecting user secrets on the web. Firstly, during the password composition phase, we investigate the entropy and resilience of user-generated passwords. Despite their vulnerability to exploits and inherent weaknesses that lead to many data breaches, password-based authentication systems remain prevalent. Motivated by the lack of consensus on password composition policy and strength, we ask if there exists a secure, human-chosen, and memorable password. To address this, we introduce the first-ever human-labelled password dataset and utilise Large Language Models to expedite the labelling process.
Secondly, in the client-side stage, we examine the threats associated with the transmission and handling of user secrets within the browser environment. We design and implement an out-of-band method, FormL3SS, to circumvent Man-in-the-Browser malware.
Finally, we focus on the server-side security phase---the final stage in the journey of user secrets. We explore whether identity-based cryptosystems can replace traditional hash functions for password-based authentication. Using these cryptosystems, we design and implement a password-less protocol---deeID.
It is clear that modern web authentication, dominated by password, and its trajectory of progress is unsustainable. The current stopgap approach of bolstering password weaknesses through additional layers, such as MFA, has resulted in user frustration and, paradoxically, in many cases introduced new vulnerabilities. We hope that our work will inspire a paradigm shift and encourage a bold leap towards new passwordless and usable authentication systems.
Version
Open Access
Date Issued
2025-02-26
Date Awarded
2025-11-01
Copyright Statement
Attribution-NonCommercial 4.0 International Licence (CC BY-NC)
License URL
Advisor
Knottenbelt, William
Sponsor
Engineering and Physical Sciences Research Council
Publisher Department
Department of Computing
Publisher Institution
Imperial College London
Qualification Level
Doctoral
Qualification Name
Doctor of Philosophy (PhD)