Password Proxy Injection via Request Interceptor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in managing multiple passwords for various web applications and services, with existing password managers making passwords vulnerable to malicious software due to direct filling into web forms.
Innovation Solution
A password manager system that creates a password proxy by transforming received data, which is used to intercept and replace a password proxy in a login request, ensuring the actual password is only revealed to the server application, thereby protecting it from malicious software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a browser plugin fills passwords directly into web forms, then password management is simplified for users, but passwords become vulnerable to malicious JavaScript or malicious browser plugins/extensions
Solution Approach 1:
The patent introduces a password proxy as an intermediary between the password manager and the web form. Instead of directly filling the actual password into the form, the system creates and fills a password proxy (encrypted or transformed version) that cannot be used by malicious software. The actual password remains protected in the password manager while still enabling authentication functionality.
Solution Approach 2:
The system creates a copy of the password in the form of a password proxy that mimics the structure and function of the actual password but cannot be used for unauthorized access. This copy is filled into the web form while the original password remains secure in the password manager database.
2Ease of operation
If passwords are stored and reused across multiple applications, then user convenience is improved, but security risks increase due to potential exposure
Solution Approach 1:
The patent applies different quality properties to different parts of the password system. The actual password is stored with high security protection in the password manager, while the password proxy filled into forms has the appropriate quality for form submission but cannot be misused. Each component has the specific properties needed for its function while maintaining overall system security.
Data Source
AI summary
A password manager injects credentials into a web browser request. A user can browse to a form provided by a server that includes a password field. A plug-in requests a password for the field from a password manager. The actual password is not provided to the plug-in or the browser. The password manager provides a proxy password that is not the actual password for the field. A request interceptor in a separate process from the browser intercepts the completed request as it is sent to the server and replaces the proxy password with the actual password.