Conference Papers Year : 2024

SecPassInput: Towards Secure Memory and Password Handling in Web Applications

Pascal Wichmann
  • Function : Author
  • PersonId : 1509098
August See
  • Function : Author
  • PersonId : 1509099
Hannes Federrath
  • Function : Author
  • PersonId : 1509100

Abstract

JavaScript does not provide web applications the ability to overwrite or clear variables of primitive types, such as strings, when they are no longer required. Applications instead need to rely on the garbage collector to eventually clear sensitive data from memory. When accessing input fields natively provided by the browser via JavaScript, their values are accessed through primitive type variables and thus affected by this limitation.In this paper, we analyze how the popular browsers Chrome, Chromium, Firefox, Opera, and Edge handle input values in memory. We find that sensitive values almost always remain in memory several minutes longer than necessary.We propose the JavaScript library SecPassInput that simulates a non-native input for passwords. The library does not rely on variables of a primitive type, thereby giving web applications the ability to clear and overwrite values in memory. We evaluate the security benefits of SecPassInput by measuring how long values remain in memory after they are no longer needed, finding that the on-screen keyboard of SecPassInput guarantees immediate removal from memory after triggering SecPassInput ’s clear operation.
Embargoed file
Embargoed file
1 10 10
Year Month Jours
Avant la publication
Friday, January 1, 2027
Embargoed file
Friday, January 1, 2027
Please log in to request access to the document

Dates and versions

hal-04953433 , version 1 (18-02-2025)

Licence

Identifiers

Cite

Pascal Wichmann, August See, Hannes Federrath. SecPassInput: Towards Secure Memory and Password Handling in Web Applications. 38th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2023, Poznan, Poland. pp.236-249, ⟨10.1007/978-3-031-56326-3_17⟩. ⟨hal-04953433⟩
0 View
0 Download

Altmetric

Share

More