article · 2025
Building and Testing a Hidden-Password Online Password Manager
Mohammed Jubur, Christopher R. Price, Maliheh Shirvanian, Nitesh Saxena, Stanislaw Jarecki, Hugo Krawczyk
IEEE Transactions on Information Forensics and Security
About this work
Abstract
This work presents HIPPO, a cloud-based hidden-password online password manager designed so that the service does not learn or store either the user's master password or the site-specific account passwords. HIPPO uses device-enhanced password-authenticated key exchange and an oblivious pseudorandom function to reconstruct strong, unique credentials on demand. The paper describes a complete implementation and evaluates its resistance to online guessing, offline dictionary attacks, service compromise, and phishing. A laboratory usability study comparing HIPPO with a conventional online password manager found that participants considered HIPPO usable for everyday authentication and perceived it as offering stronger security, privacy, and trust.
Access
Read the paper
Reference
Citation
Mohammed Jubur, Christopher R. Price, Maliheh Shirvanian, Nitesh Saxena, Stanislaw Jarecki, Hugo Krawczyk (2025). Building and Testing a Hidden-Password Online Password Manager. IEEE Transactions on Information Forensics and Security, 20, 7454–7468. https://doi.org/10.1109/TIFS.2025.3583459