Anzeige
Erschienen in:
2024 | OriginalPaper | Buchkapitel
SecPassInput: Towards Secure Memory and Password Handling in Web Applications
verfasst von : Pascal Wichmann, August See, Hannes Federrath
Erschienen in: ICT Systems Security and Privacy Protection
Verlag: Springer Nature Switzerland
Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.
Wählen Sie Textabschnitte aus um mit Künstlicher Intelligenz passenden Patente zu finden. powered by
Markieren Sie Textabschnitte, um KI-gestützt weitere passende Inhalte zu finden. powered by
Abstract
JavaScript does not provide web applications the ability to overwrite or clear variables of primitive types, such as strings, when they are no longer required. Applications instead need to rely on the garbage collector to eventually clear sensitive data from memory. When accessing input fields natively provided by the browser via JavaScript, their values are accessed through primitive type variables and thus affected by this limitation.
In this paper, we analyze how the popular browsers Chrome, Chromium, Firefox, Opera, and Edge handle input values in memory. We find that sensitive values almost always remain in memory several minutes longer than necessary.
We propose the JavaScript library SecPassInput that simulates a non-native input for passwords. The library does not rely on variables of a primitive type, thereby giving web applications the ability to clear and overwrite values in memory. We evaluate the security benefits of SecPassInput by measuring how long values remain in memory after they are no longer needed, finding that the on-screen keyboard of SecPassInput guarantees immediate removal from memory after triggering SecPassInput ’s clear operation.