Browser Extension Credential Protection Against Phishing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks pose a significant threat to computer systems as users often unknowingly provide credentials to malicious websites that resemble legitimate ones, and existing solutions rely on user vigilance or constant updates of blacklists, which are ineffective.
Innovation Solution
A computer system that intercepts and encrypts user input in password fields, compares it to a list of stored encrypted passwords, and takes protective measures such as alerting the user or blocking the input if a match is found, using a bootstrapping phase to collect and store passwords from trusted websites and employing an overlay or alternate characters to prevent initial password exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users manually verify website legitimacy before entering credentials, then security awareness is improved, but user convenience deteriorates and human error remains a vulnerability
Solution Approach 1:
The system automatically performs security verification by comparing the current website's public key against stored trusted certificates and blacklisted certificates, eliminating the need for user intervention. The browser extension autonomously detects phishing attempts and blocks credential entry without requiring users to manually verify website legitimacy.
Solution Approach 2:
A browser extension acts as an intermediary between the user and the website, intercepting credential input and performing automated verification. The extension mediates the authentication process by checking certificates and blocking malicious sites before credentials can be compromised.
2Reliability
If blacklists of malicious websites are constantly updated, then detection capability is improved, but system complexity and maintenance burden increase
Solution Approach 1:
Instead of maintaining complex blacklists of malicious websites, the system copies and stores legitimate website certificates during a bootstrapping phase. This inverted approach stores trusted references rather than untrusted threats, simplifying the system while improving detection accuracy through cryptographic verification.
Solution Approach 2:
The system changes the verification parameter from checking website URLs against blacklists to verifying cryptographic certificates. This parameter change transforms the problem from pattern matching to mathematical verification, improving reliability while reducing maintenance complexity.
3Reliability
If password input is intercepted and verified in real-time, then security protection is improved, but processing time and computational overhead increase
Solution Approach 1:
The system performs certificate verification and blacklist checking before the user completes password entry. By initiating security verification as soon as the password field is focused, the system prevents credential transmission to malicious sites without requiring post-entry processing, minimizing time loss.
Solution Approach 2:
The system extracts and verifies only the necessary security credentials (website certificates and domain names) before password verification, separating the security check from the full authentication process. This extraction allows rapid verification without processing entire credential sets.
Data Source
AI summary
A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to receive a sequence of characters within a field of a web browser, the field being associated with a password entry field served to the web browser from a website. The processor is further configured to store the received sequence of characters and send an alternate sequence of characters to the website. The processor is further configured to encrypt the received sequence of characters to generate a received encrypted partial password and compare the received encrypted partial password to one or more entries in a list of encrypted partial passwords. The processor is further configured to, in response to the comparison resulting in a difference, delete the previously sent alternate sequence of characters, and send the stored sequence of characters to the website.