Skip to main content
Springer Nature Link
Log in

Password Managers and Vault Application Security and Forensics: Research Challenges and Future Opportunities

  • Conference paper
  • First Online:
Digital Forensics and Cyber Crime (ICDF2C 2023)

Included in the following conference series:

  • 599 Accesses

Abstract

Password manager and vault applications can be used by users to select strong passwords as well as storing user credentials locally or in the cloud. Such apps have been studied by various security researchers, for example in identifying potential vulnerabilities and bugs, as well as proposing techniques to forensically recover artifacts of interest/relevance to an investigation, which is also the focus of this paper. Specifically, we review the extant literature on the security and forensics of password manager and vault applications with the objective of identifying existing limitations and challenges.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

References

  • Alkaldi, N., Renaud, K.: MIGRANT: modeling smartphone password manager adoption using migration theory. ACM SIGMIS Database: DATABASE Adv. Inf. Syst. 53(2), 63–95 (2022)

    Google Scholar 

  • AlMuhanna, A., AlFaadhel, A., Ara, A.: Enhanced system for securing password manager using honey encryption. In: 2022 Fifth International Conference of Women in Data Science at Prince Sultan University (WiDS PSU). IEEE (2022)

    Google Scholar 

  • Aonzo, S., et al.: Phishing attacks on modern android. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (2018)

    Google Scholar 

  • Apostolopoulos, D., Marinakis, G., Ntantogian, C., Xenakis, C.: Discovering authentication credentials in volatile memory of android mobile devices. In: Douligeris, C., Polemi, N., Karantjias, A., Lamersdorf, W. (eds.) I3E 2013. IFIP Advances in Information and Communication Technology, vol. 399, pp. 178–185. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-37437-1_15

    Chapter  Google Scholar 

  • Barten, D.: Client-side attacks on the LastPass browser extension (2019)

    Google Scholar 

  • Carr, M., Shahandashti, S.F.: Revisiting security vulnerabilities in commercial password managers. In: Hölbl, M., Rannenberg, K., Welzer, T. (eds.) SEC 2020. IFIP Advances in Information and Communication Technology, vol. 580, pp. 265–279. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-58201-2_18

    Chapter  Google Scholar 

  • Chatterjee, R., et al.: Cracking-resistant password vaults using natural language encoders. In: 2015 IEEE Symposium on Security and Privacy. IEEE (2015)

    Google Scholar 

  • Chaudhary, S., et al.: Usability, security and trust in password managers: a quest for user-centric properties and features. Comput. Sci. Rev. 33, 69–90 (2019)

    Article  Google Scholar 

  • Dorai, G., et al.: Vide-vault app identification and extraction system for iOS devices. Forensic Sci. Int.: Digit. Invest. 33, 301007 (2020)

    Google Scholar 

  • Fagan, M., et al.: An investigation into users’ considerations towards using password managers. Hum.-Cent. Comput. Inf. Sci. 7(1), 1–20 (2017)

    Article  Google Scholar 

  • Fahl, S., Harbach, M., Oltrogge, M., Muders, T., Smith, M.: Hey, you, get off of my clipboard. In: Sadeghi, A.R. (ed.) FC 2013. Lecture Notes in Computer Science, vol. 7859, pp. 144–161. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-39884-1_12

    Chapter  Google Scholar 

  • Gasti, P., Rasmussen, K.B.: On the security of password manager database formats. In: Foresti, S., Yung, M., Martinelli, F. (eds.) ESORICS 2012. LNCS, vol. 7459, pp. 770–787. Springer, Berlin, Heidelberg (2012). https://doi.org/10.1007/978-3-642-33167-1_44

    Chapter  Google Scholar 

  • Gilbert, A., Seigfried-Spellar, K.C., Gilbert, A.K.: Forensic discoverability of iOS vault applications. J. Digit. Forensics Secur. Law 17(1), 1 (2022)

    Google Scholar 

  • Gonzalez, R., Chen, E.Y., Jackson, C.: Automated password extraction attack on modern password managers. arXiv preprint arXiv:1309.1416 (2013)

  • Gray, J., Franqueira, V.N.L., Yu, Y.: Forensically-sound analysis of security risks of using local password managers. In: 2016 IEEE 24th International Requirements Engineering Conference Workshops (REW). IEEE (2016)

    Google Scholar 

  • He, Y., Wang, R., Shi, W.: Implementation of a TPM-based security enhanced browser password manager. Wuhan Univ. J. Nat. Sci. 21(1), 56–62 (2016)

    Article  Google Scholar 

  • Huaman, N., et al.: They would do better if they worked together: the case of interaction problems between password managers and websites. In: 2021 IEEE Symposium on Security and Privacy (SP). IEEE (2021)

    Google Scholar 

  • Li, Z., et al.: The {Emperor’s} new password manager: security analysis of web-based password managers. In: 23rd USENIX Security Symposium (USENIX Security 2014) (2014)

    Google Scholar 

  • Li, Y., Wang, H., Sun, K.: Bluepass: a secure hand-free password manager. In: Lin, X., Ghorbani, A., Ren, K., Zhu, S., Zhang, A. (eds.) SecureComm 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol. 238, pp. 185–205. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-78813-5_10

    Chapter  Google Scholar 

  • Luevanos, C., et al.: Analysis on the security and use of password managers. In: 2017 18th International Conference on Parallel and Distributed Computing, Applications and Technologies (PDCAT). IEEE (2017)

    Google Scholar 

  • Martini, B., Do, Q., Choo, K.-K.R.: Mobile cloud forensics: an analysis of seven popular Android apps. arXiv preprint arXiv:1506.05533 (2015)

  • Ntantogian, C., et al.: Evaluating the privacy of Android mobile applications under forensic analysis. Comput. Secur. 42, 66–76 (2014)

    Article  Google Scholar 

  • Oesch, S., et al.: “It basically started using me”: an observational study of password manager usage. In: CHI Conference on Human Factors in Computing Systems (2022)

    Google Scholar 

  • Oesch, S., Gautam, A., Ruoti, S.: The emperor’s new autofill framework: a security analysis of autofill on iOS and Android. In: Annual Computer Security Applications Conference (2021)

    Google Scholar 

  • Oesch, S., Ruoti, S.: That was then, this is now: a security evaluation of password generation, storage, and autofill in browser-based password managers. In: Proceedings of the 29th USENIX Conference on Security Symposium (2020)

    Google Scholar 

  • Peng, M., et al.: DECADE-deep learning based content-hiding application detection system for Android. In: 2021 IEEE International Conference on Big Data (Big Data). IEEE (2021)

    Google Scholar 

  • Sabev, P., Petrov, M.: Android password managers and vault applications: data storage security issues identification. J. Inf. Secur. Appl. 67, 103152 (2022)

    Google Scholar 

  • Sabev, P., Petrov, M.: Android password managers and vault applications: an investigation on data remanence in main memory (2021a)

    Google Scholar 

  • Ruffin, M., et al.: Casing the vault: security analysis of vault applications. In: Proceedings of the 21st Workshop on Privacy in the Electronic Society (2022)

    Google Scholar 

  • Sabev, P., Petrov, M.: Android password managers and vault applications: comparative security analysis. In: 2021 International Conference Automatics and Informatics (ICAI). IEEE (2021b)

    Google Scholar 

  • Shirvanian, M., et al.: A hidden-password online password manager. In: Proceedings of the 36th Annual ACM Symposium on Applied Computing (2021)

    Google Scholar 

  • Silver, D., et al.: Password managers: attacks and defenses. In: 23rd USENIX Security Symposium (USENIX Security 2014) (2014)

    Google Scholar 

  • Stobert, E., Biddle, R.: A password manager that doesn’t remember passwords. In: Proceedings of the 2014 New Security Paradigms Workshop (2014)

    Google Scholar 

  • Stock, B., Johns, M.: Protecting users against XSS-based password manager abuse. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications security (2014)

    Google Scholar 

  • Walkup, E.: The password problem. No. SAND2016-5208T. Sandia National Lab. (SNL-NM), Albuquerque, NM (United States) (2016)

    Google Scholar 

  • Yu, F., Yin, H.: A security analysis of the authentication mechanism of password managers. In: 2021 IEEE 21st International Conference on Communication Technology (ICCT). IEEE (20210

    Google Scholar 

  • Zhang, X., Baggili, I., Breitinger, F.: Breaking into the vault: privacy, security and forensic analysis of Android vault applications. Comput. Secur. 70, 516–531 (2017)

    Article  Google Scholar 

  • Zhao, R., Yue, C., Sun, K.: A security analysis of two commercial browser and cloud based password managers. In: 2013 International Conference on Social Computing. IEEE (2013)

    Google Scholar 

  • Zhao, R., Yue, C.: All your browser-saved passwords could belong to us: a security analysis and a cloud-based new design. In: Proceedings of the third ACM Conference on Data and Application Security and Privacy (2013)

    Google Scholar 

  • Zhao, R., Yue, C., Sun, K.: Vulnerability and risk analysis of two commercial browser and cloud based password managers. ASE Sci. J. 1(4), 1–15 (2013)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of Texas at San Antonio, San Antonio, TX, 78249, USA

    Aleck Nash & Kim-Kwang Raymond Choo

Authors
  1. Aleck Nash
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Kim-Kwang Raymond Choo
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Kim-Kwang Raymond Choo .

Editor information

Editors and Affiliations

  1. University of Albany, Albany, GA, USA

    Sanjay Goel

  2. Universidade Federal do Espírito Santo, Alegre, Brazil

    Paulo Roberto Nunes de Souza

Rights and permissions

Reprints and permissions

Copyright information

© 2024 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Nash, A., Choo, KK.R. (2024). Password Managers and Vault Application Security and Forensics: Research Challenges and Future Opportunities. In: Goel, S., Nunes de Souza, P.R. (eds) Digital Forensics and Cyber Crime. ICDF2C 2023. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 571. Springer, Cham. https://doi.org/10.1007/978-3-031-56583-0_3

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-56583-0_3

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-56582-3

  • Online ISBN: 978-3-031-56583-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics