Phd Thesis-Fatma Abdullah AL Maqbali: Strengthening Password
Total Page：16
File Type：pdf, Size：1020Kb
Strengthening Password-Based Authentication Submitted by Fatma Abdullah Amer AL Maqbali for the degree of Doctor of Philosophy of the Royal Holloway, University of London 2019 Declaration I, Fatma Abdullah Amer AL Maqbali, hereby declare that this thesis and the work presented in it is entirely my own. Where I have consulted the work of others, this is always clearly stated. Signed. .(Fatma Abdullah Amer AL Maqbali) Date: i To my husband Nasser, my daughter Azzahraa, and my father. ii Abstract Authenticating humans to computers remains problematic despite decades of effort. Password-based authentication remains extremely common, in spite of its widely known shortcomings, and this seems likely to continue. Hence improving the security of pass- word use is a topic of huge practical importance | this observation provides the mo- tivation for the work described in this thesis. We focus in particular on two topics, namely password generators and password recovery. Password generators provide site-specific passwords on demand, facilitating the use of site-specific and complex passwords; they are an alternative to password managers that avoid storing passwords long-term. We proposed a general model for such sys- tems, and critically examine options for instantiating this model, including all those previously proposed. The model has also been used to help design a new scheme, Au- toPass, intended to incorporate the best features of the prior art whilst also addressing many of the most serious shortcomings of existing systems through use of novel tech- niques. AutoPass is specified in detail, and a prototype implementation is described. The prototype has been user-trialled to test its usability and security. Because passwords are very widely used for user authentication, most websites us- ing passwords also implement password recovery to allow users to re-establish a shared secret if the existing value is forgotten; however, use of such a fall-back creates addi- tional vulnerabilities. We present a model for such systems, and use this to analyse existing approaches. This leads naturally to a set of recommendations for system im- plementation. Many password recovery systems involve sending a special email to the user, e.g. containing a secret link, in which case security will depend on the email being acted upon correctly; unfortunately, such emails are not always well-designed and can introduce vulnerabilities. To understand better this serious practical issue, we surveyed password recovery emails for 50 of the top English language websites and investigated their design, structure and content. We found that many well-known web services, including Facebook, Dropbox, and Microsoft, suffer from recovery email design, struc- ture and content issues. This study enabled us to formulate recommendations for the design of such emails. iii Acknowledgements The research in this thesis would not have been possible to complete without the encouragement of many people. It is a delight to acknowledge all those who have supported me over the last four years. I am sincerely and heartily grateful to Professor Chris J. Mitchell, my PhD super- visor, for his endless support, guidance, motivation, patience and immense knowledge throughout my PhD study and related research. His guidance helped me throughout the time spent in performing the research for and writing up of this thesis. I could not have imagined having a better supervisor for my PhD study. I cannot find words to express my heartfelt thanks to my soul mate, my workmate, my best friend, and my husband, Nasser, for his continued and unfailing love, support and understanding before and during our study of PhD degree. He is always been the one for me to lean on at all times. I owe thanks to my lovely daughter, Azzahraa who is the pride and joy of my life. Having her during my PhD gave me strength and helped me to be more efficient. I wholeheartedly thank my late father, Abdullah Amer AL Maqbali who could not see this thesis completed and who always believed in me, supported me in every decision I made and every step I took to ensure that I reach where I want to be. He was always keen to know what I was doing and how I was proceeding. I miss his smile of joy whenever a significant moment was reached. A very special gratitude goes to my aunties Moza and Saleema who have always been on my side throughout my journey. I would particularly like to thank Dr Wanpeng Li who dedicated his free time voluntarily to develop the AutoPass extension which is an important part of the thesis. I am profoundly appreciative to my colleagues, Ms Angela Heeler, Mr Gaetan Pradel, Mr Zhaoyi Fan, Dr Wanpeng Li, Ms Zhang Xiao, Mr Mohammed Shafiul Alam Khan, and my husband Nasser for the friendly atmosphere they have created for our reading group, and for the invaluable feedback and insightful ideas I got from them. I would like to show my gratitude to my siblings: Amur, Wafa, Maryam, Noof, Suleiman, Mohammed, Majed, Ashwaq, Ayman, Areem and Turkey. I am very grateful to my mother Shaika AL Maqbali, my step-mother Shaika AL Maqbali, my mother-in-law Suad Al-Fannah, my father-in-law Mohammed Al-Fannah and all my relatives and friends. Finally, I owe sincere and earnest thankfulness to Allah who gave me the blessing to have amazing people in my life and for giving me the strength to do my PhD. iv Contents 1 Introduction1 1.1 Passwords...................................1 1.2 Managing Passwords.............................2 1.3 Contributions.................................3 1.4 Joint Work..................................4 1.5 List of Publications..............................4 1.6 Structure of Thesis..............................5 I Background7 2 User Authentication8 2.1 Introduction..................................8 2.1.1 Identification and Authentication..................8 2.1.2 User Authentication to Computers.................9 2.1.3 User Authentication Model..................... 11 2.2 The User Authentication Lifecycle..................... 13 2.2.1 The Main Steps............................ 13 2.2.2 Registration.............................. 13 2.2.3 Performing Authentication..................... 13 2.2.4 Account Maintenance........................ 14 2.2.5 Account Closure........................... 14 2.3 Passwords: Use and Vulnerabilities..................... 15 2.3.1 Setting up a Password........................ 15 2.3.2 Using Passwords........................... 15 2.3.3 Password Vulnerabilities....................... 17 2.3.4 Verifying Passwords......................... 17 2.4 Password Managers.............................. 18 2.5 Password Generators............................. 22 v 2.6 Password Recovery.............................. 22 2.7 Conclusions.................................. 23 3 Password Generators 24 3.1 Introduction.................................. 24 3.2 A Definition................................. 24 3.3 Previous Work................................ 25 3.4 A Taxonomy................................. 33 3.5 Shortcomings of Existing Techniques.................... 34 3.6 Conclusions.................................. 35 4 Password Recovery 36 4.1 Introduction.................................. 36 4.2 Previous Work................................ 37 4.3 Issues with Password Recovery....................... 41 4.4 Conclusions.................................. 42 II Password Generation 43 5 Password Generators: Old Ideas and New 44 5.1 Introduction.................................. 44 5.2 The Model.................................. 45 5.2.1 Operation............................... 45 5.2.2 Registration and Configuration................... 46 5.3 Components of the Model.......................... 46 5.3.1 Inputs to Password Generation................... 46 5.3.2 Generating the Password...................... 47 5.3.3 Password Output and Use...................... 49 5.3.4 Approaches to Implementation................... 49 5.4 Assessing the Options............................ 50 5.4.1 Inputs................................. 50 5.4.2 Generating the Password...................... 51 5.4.3 User Interface Operation....................... 52 5.4.4 Implementation............................ 52 5.4.5 Other Issues.............................. 53 5.5 Improving System Operation........................ 54 5.5.1 Novel Types of Configuration Data................. 54 5.5.2 Use of A Server............................ 55 vi 5.6 Conclusions.................................. 56 6 AutoPass: An Automatic Password Generator 57 6.1 Introduction.................................. 57 6.2 AutoPass: High-level Specification..................... 58 6.3 AutoPass: Detailed Specification...................... 59 6.3.1 Structure............................... 59 6.3.2 Operation............................... 59 6.3.3 Stored Data.............................. 63 6.3.4 Use of PRML............................. 64 6.3.5 Password Offsets........................... 65 6.4 Details of Operation............................. 66 6.4.1 Application Installation....................... 66 6.4.2 Operational Sessions......................... 68 6.4.3 Use with a Website.......................... 70 6.5 Other Aspects................................. 72 6.6 Security Evaluation.............................. 73 6.6.1 Trust Relationships......................... 73 6.6.2 Threat Model............................. 73 6.6.3 Security Properties.......................... 74 6.6.4 Security from An Attacker Perspective............... 75 6.7 Addressing Shortcomings.........................