Security evaluation of password manager browser extensions

Abstract

Password managers are used for storing the user's login credentials and other important information such as the card details and payment receipts. There has been a surge in the number of users depending on the password managers for their day-to-day use. This, as a result, has motivated multiple software companies to develop password management applications.

The information stored in the password managers are encrypted using a master passphrase. Essentially, the password managers act as the centralized storage point for all the sensitive data. They usually communicate with the web applications through web browser extensions. Even though the password managers are protected by strong encryption techniques, there have been instances in the past where the password managers have been compromised. Hence, it is necessary to ensure that the password managers are built following strict security standards.

In this thesis, we study F-secure KEY, which has already undergone previous security reviews, and perform a security evaluation of its browser extension. The extension plays an important role in fetching the user credentials from the p