They Would do Better if They Worked Together: The Case of Interaction Problems Between Password ...

### Overview In this presentation, Nicolas Swearman discusses research on interaction problems between password managers and websites. While password managers are recommended to alleviate the burden of memorizing unique, randomly generated credentials, their real-world operation relies heavily on browser extensions that inspect web pages and inject authentication functionality. Due to the complexity of website architectures and varying implementations of login and registration forms, password managers frequently fail to detect fields or properly autofill credentials.

### Key Topics - **Password Reuse and User Perceptions**: According to a February 2019 online survey, 69% of participants believed they were very good at protecting online accounts and 59% believed they were safer than average. However, 52% admitted to reusing passwords across multiple accounts, 13% reused passwords for all accounts, and only 24% reported using a password manager. - **Dataset and Issue Mining**: The researchers collected user-reported bugs across open-source repositories and extension stores, gathering 1,300 reviews across 15 password managers on the Chrome Web Store, 400 GitHub issues, and 729 Chrome Web Store support requests. Three authors filtered these reports for website interaction issues, establishing a codebook that yielded 152 relevant issues. - **Categorization and Minimal Working Examples**: From the 152 issues, the authors identified 7 broad categories and 39 distinct problematic interaction patterns. They constructed minimal working examples (MWEs)—simplified HTML snippets isolating the specific form or script interaction (e.g., Google's two-page login flow)—to systematically evaluate password manager behavior. - **Automated Testing Setup**: Testing was performed using an automated Selenium script that launched clean Chrome environments with the target password manager installed, allowing researchers to evaluate compatibility against each minimal working example.

### Technical Details The authors evaluated the 15 most downloaded password managers on the Chrome Web Store alongside 3 built-in browser vendor managers (Google Chrome, Mozilla Firefox, and Microsoft Edge).

Key findings and failure modes include: - **Failure Rates**: 17 out of the 39 interactions failed to operate seamlessly across more than five password managers. Notably, no single password manager succeeded across all tested interactions. - **Domain Matching**: Password managers struggle to safely decide whether credentials should be shared across subdomains or related domains without risking credential leakage. - **Input Field Attributes**: Lack of standardized support or handling for attributes like `autocomplete` or length constraints (e.g., maximum password length). - **JavaScript Interferences**: Client-side scripts that intercept inputs (such as scripts that capture keystrokes and replace field values with asterisks prior to form submission) or dynamically generated input fields that appear only after explicit user interaction. - **Complex Form Elements**: Multi-input PIN fields composed of separate HTML tags, split name fields (first name and last name instead of a single username), and pages containing multiple forms simultaneously (such as registration and login forms on one page).

### Takeaways and Proposed Solutions - **Adoption of Existing Standards**: Many compatibility issues can be resolved immediately if web developers and password managers consistently support existing HTML standards, particularly the `autocomplete` attribute (including support for one-time passcodes / TOTP) and input format specifiers. - **Emerging Specifications**: Adoption of newer standards, such as Apple's proposed `passwordrules` attribute, can allow websites to explicitly communicate password complexity and character requirements directly to password managers. - **Credential Sharing Standard**: To address domain matching across subdomains (e.g., `example.com` and `auth.example.com`), the authors propose establishing a new HTTP header or HTML tag mechanism (similar to CSP or CORS). Password managers could issue a lightweight HEAD request to verify whether credential sharing is authorized between origins. - **Replication Package**: The authors released a replication package containing the minimal working example test site, Selenium scripts, and video recordings demonstrating each tested interaction.