Abstract. Password managers are critical pieces of software relied upon by users to securely store valuable and sensitive information, from online banking passwords and login credentials to passport-and social security numbers. Surprisingly, there has been very little academic research on the security these applications provide. This paper presents the first rigorous analysis of storage formats used by popular password managers. We define two realistic security models, designed to represent the capabilities of real-world adversaries. We then show how specific vulnerabilities in our models allow an adversary to implement practical attacks. Our analysis shows that most password manager database formats are broken even against weak adversaries.
Gasti and Rasmussen REF investigate the security properties of the password database formats used in range of popular password managers.
On the Security of Password Manager Database Formats
ESORICS
Computer Science