SafeKeeper: Protecting Web Passwords using Trusted Execution Environments

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review


Research units

  • Concordia University


Passwords are by far the most widely-used mechanism for authenticating users on the web, out-performing all competing solutions in terms of deployability (e.g. cost and compatibility). However, two critical security concerns are phishing and theft of password databases. These are exacerbated by users» tendency to reuse passwords across different services. Current solutions typically address only one of the two concerns, and do not protect passwords against rogue servers. Furthermore, they do not provide any verifiable evidence of their (server-side) adoption to users, and they face deployability challenges in terms of ease-of-use for end users, and/or costs for service providers. We present SafeKeeper, a novel and comprehensive solution to ensure secrecy of passwords in web authentication systems. Unlike previous approaches, SafeKeeper protects users» passwords against very strong adversaries, including external phishers as well as corrupted (rogue) servers. It is relatively inexpensive to deploy as it (i) uses widely available hardware-based trusted execution environments like Intel SGX, (ii) requires only minimal changes for integration into popular web platforms like WordPress, and (iii) imposes negligible performance overhead. We discuss several challenges in designing and implementing such a system, and how we overcome them. Via an 86-participant user study, systematic analysis and experiments, we show the usability, security and deployability of SafeKeeper, which is available as open-source.


Original languageEnglish
Title of host publicationWWW '18 : Proceedings of the 2018 World Wide Web Conference
Publication statusPublished - 23 Apr 2018
MoE publication typeA4 Article in a conference publication
EventThe Web Conference - Lyon, France
Duration: 23 Apr 201827 Apr 2018


ConferenceThe Web Conference
Abbreviated titleWWW
Internet address

    Research areas

  • Passwords, Phishing, Intel SGX, Trusted Execution Environme

Download statistics

No data available

ID: 27036050