A Hidden-Password Online Password Manager

About this work

Abstract

This early work introduces a hidden-password online password manager that aims to protect users even if the password-management service is compromised. Rather than storing site passwords in a conventional online vault, the design uses cryptographic password derivation so the manager does not learn or retain the user's master password or the resulting account passwords. The paper motivates the threat model, presents the core protocol and proof-of-concept implementation, and shows how strong service-specific credentials can be reconstructed when needed while reducing exposure to password-manager breaches, offline guessing, and phishing. The work forms the foundation for the later full HIPPO design and evaluation.