SecPassInput: Towards Secure Memory and Password Handling in Web Applications
Abstract
JavaScript does not provide web applications the ability to overwrite or clear variables of primitive types, such as strings, when they are no longer required. Applications instead need to rely on the garbage collector to eventually clear sensitive data from memory. When accessing input fields natively provided by the browser via JavaScript, their values are accessed through primitive type variables and thus affected by this limitation.In this paper, we analyze how the popular browsers Chrome, Chromium, Firefox, Opera, and Edge handle input values in memory. We find that sensitive values almost always remain in memory several minutes longer than necessary.We propose the JavaScript library SecPassInput that simulates a non-native input for passwords. The library does not rely on variables of a primitive type, thereby giving web applications the ability to clear and overwrite values in memory. We evaluate the security benefits of SecPassInput by measuring how long values remain in memory after they are no longer needed, finding that the on-screen keyboard of SecPassInput guarantees immediate removal from memory after triggering SecPassInput ’s clear operation.