# Bingo: A Semi-Centralized Password Storage System
## 1 Introduction  
Users of online services define secrets such as passwords and place their trust in these services to keep their secrets secure from attackers. Passwords, along with some user identifiers such as an email address, are used to authenticate a user's identity when logging into a service [1]. Recent studies show that the number of accounts that a single user may use on a weekly basis has grown substantially over the past decade [2]. A given user may be a member of close to a dozen social media platforms, have a number of password-protected bank accounts, maintain profiles for work related tasks, and so forth. As such, a daunting level of trust is placed on online services [3]. With that said, countless password breaches in the past two decades have caused millions of stolen identities and billions of dollars in damages to both individual users and online companies [4]. Malicious groups have become more adept at exploiting common mistakes in password storage databases and web protocols, requiring companies to quickly apply security patches which often only expose further vulnerabilities in their services [5; 6; 7]. Passwords may be stored in plain text, hashed with or without a salt, or reversibly encrypted [8]. Generally, a password is stored alongside other user identifying information in a database such as PostgreSQL or MongoDB [9]. The state-of-the-art password hashing algorithms are Bcrypt, Scrypt, and Argon2. Modern best security practices state that while hashing a password, a number of salt rounds should be included to add increased entropy [10]. Salting a password prevents common attacks such as pre-computed \"rainbow tables\" for offline attacks [11; 12]. In an ideal scenario, an attacker should require a practically infinite amount of time (i.e., decades) to crack a hashed password [13]. Unfortunately,a staggering number of online services still use outdated algorithms for hashing passwords or even go as far as storing passwords in plain text. If an attacker is able to recover a password either by cracking its hash or simply reading it in plain text, a user's account may become compromised, and the attacker is able to cause damage such as identity theft and attain private banking information. Due to a rise in compromised passwords, Google unveiled the earliest commercial version of 2 FA in 2011 [14]. Since then, nearly all secure online services utilize some form of \"out of band\" verification of a user's identity. An out of band verification requires that the user prove their identity through another means outside of the current session they are a part of. This includes but is not limited to a one-time code emailed to the user or a ping notification on a smartphone application. In the common case of a ping notification, both the user's device and the 2 FA provider's server use a shared secret to generate a one-time password (i.e., OTP) [15]. If both parties generate the same password, the authentication succeeds. By using 2 FA, an online service makes stronger guarantees as to the safety of its users' information, since even a compromised password requires an attacker to compromise another authentication mechanism belonging to the user, which is oftentimes quite difficult [16]. Rather than tackling compromised passwords through another form of authentication, Password aggregators such as LastPass aim to combat passwords that are easy to guess, as well as the reuse of passwords [17]. An aggregator requires that a user choose a \"master password\", which is then used to access a collection of all of the user's passwords for all online services. An aggregator will oftentimes provide the ability to choose randomly generated passwords and later pre-fill them for a user upon login [18]. This provides the benefit that the user only has a single password to remember, as well as removing the requirement from the user to choose many unique hard to remember passwords. Today, most leading web browsers provide this service as a built in feature.