Extending the Scope of CardSpace

Haitham S Al-Sinani; Chris J Mitchell

doi:10.1145/2070425.2070467

Extending the Scope of CardSpace

Haitham S Al-Sinani, Chris J Mitchell

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

293 Downloads (Pure)

Abstract

The recently-proposed PassCard scheme enables CardSpace to be used as a password manager, thereby both improving the usability and security of passwords as well as encouraging CardSpace adoption. However, this scheme does not work with sites using HTTPS, seriously limiting its practicality. In this paper we extend PassCard to support sites using both HTTP and HTTPS. Usernames and passwords are stored in CardSpace personal cards, and these cards can be used to sign on transparently to corresponding websites. PassCard does not require any changes to login servers, default browser security settings or to the CardSpace identity selector; in particular, it does not require websites to support CardSpace. PassCard operates with both the CardSpace and the Higgins identity selectors without any modification. We describe how this new version of PassCard operates, and give security and usability analyses.

Original language	English
Title of host publication	Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011
Editors	M A Orgun, A Elci, O B Makarevich, S A Huss, J Pieprzyk, L K Babenko, A G Chefranov, R Shankaran
Place of Publication	New York
Publisher	ACM
Pages	235-238
Number of pages	4
DOIs	https://doi.org/10.1145/2070425.2070467
Publication status	Published - 2011
Event	4th International Conference on Security of Information and Networks (SIN 2011) - Sydney, Australia Duration: 14 Nov 2011 → 19 Nov 2011

Conference

Conference	4th International Conference on Security of Information and Networks (SIN 2011)
Country/Territory	Australia
City	Sydney
Period	14/11/11 → 19/11/11

Keywords

CardSpace
Password Manager
Browser Extension

Access to Document

10.1145/2070425.2070467

ExtendingTheScopeOfCardSpaceSubmitted manuscript, 208 KB

http://www.chrismitchell.net/Papers/etsocs.pdf

Cite this

Al-Sinani, H. S., & Mitchell, C. J. (2011). Extending the Scope of CardSpace. In M. A. Orgun, A. Elci, O. B. Makarevich, S. A. Huss, J. Pieprzyk, L. K. Babenko, A. G. Chefranov, & R. Shankaran (Eds.), Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011 (pp. 235-238). ACM. https://doi.org/10.1145/2070425.2070467

Al-Sinani, Haitham S ; Mitchell, Chris J. / Extending the Scope of CardSpace. Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011. editor / M A Orgun ; A Elci ; O B Makarevich ; S A Huss ; J Pieprzyk ; L K Babenko ; A G Chefranov ; R Shankaran. New York : ACM, 2011. pp. 235-238

@inproceedings{c00f7255ccd942b58e30c5800c1d0e74,

title = "Extending the Scope of CardSpace",

abstract = "The recently-proposed PassCard scheme enables CardSpace to be used as a password manager, thereby both improving the usability and security of passwords as well as encouraging CardSpace adoption. However, this scheme does not work with sites using HTTPS, seriously limiting its practicality. In this paper we extend PassCard to support sites using both HTTP and HTTPS. Usernames and passwords are stored in CardSpace personal cards, and these cards can be used to sign on transparently to corresponding websites. PassCard does not require any changes to login servers, default browser security settings or to the CardSpace identity selector; in particular, it does not require websites to support CardSpace. PassCard operates with both the CardSpace and the Higgins identity selectors without any modification. We describe how this new version of PassCard operates, and give security and usability analyses.",

keywords = "CardSpace, Password Manager, Browser Extension",

author = "Al-Sinani, {Haitham S} and Mitchell, {Chris J}",

year = "2011",

doi = "10.1145/2070425.2070467",

language = "English",

pages = "235--238",

editor = "Orgun, {M A} and A Elci and Makarevich, {O B} and Huss, {S A} and J Pieprzyk and Babenko, {L K} and Chefranov, {A G} and R Shankaran",

booktitle = "Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011",

publisher = "ACM",

note = "4th International Conference on Security of Information and Networks (SIN 2011) ; Conference date: 14-11-2011 Through 19-11-2011",

}

Al-Sinani, HS & Mitchell, CJ 2011, Extending the Scope of CardSpace. in MA Orgun, A Elci, OB Makarevich, SA Huss, J Pieprzyk, LK Babenko, AG Chefranov & R Shankaran (eds), Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011. ACM, New York, pp. 235-238, 4th International Conference on Security of Information and Networks (SIN 2011), Sydney, Australia, 14/11/11. https://doi.org/10.1145/2070425.2070467

Extending the Scope of CardSpace. / Al-Sinani, Haitham S; Mitchell, Chris J.
Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011. ed. / M A Orgun; A Elci; O B Makarevich; S A Huss; J Pieprzyk; L K Babenko; A G Chefranov; R Shankaran. New York: ACM, 2011. p. 235-238.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Extending the Scope of CardSpace

AU - Al-Sinani, Haitham S

AU - Mitchell, Chris J

PY - 2011

Y1 - 2011

N2 - The recently-proposed PassCard scheme enables CardSpace to be used as a password manager, thereby both improving the usability and security of passwords as well as encouraging CardSpace adoption. However, this scheme does not work with sites using HTTPS, seriously limiting its practicality. In this paper we extend PassCard to support sites using both HTTP and HTTPS. Usernames and passwords are stored in CardSpace personal cards, and these cards can be used to sign on transparently to corresponding websites. PassCard does not require any changes to login servers, default browser security settings or to the CardSpace identity selector; in particular, it does not require websites to support CardSpace. PassCard operates with both the CardSpace and the Higgins identity selectors without any modification. We describe how this new version of PassCard operates, and give security and usability analyses.

AB - The recently-proposed PassCard scheme enables CardSpace to be used as a password manager, thereby both improving the usability and security of passwords as well as encouraging CardSpace adoption. However, this scheme does not work with sites using HTTPS, seriously limiting its practicality. In this paper we extend PassCard to support sites using both HTTP and HTTPS. Usernames and passwords are stored in CardSpace personal cards, and these cards can be used to sign on transparently to corresponding websites. PassCard does not require any changes to login servers, default browser security settings or to the CardSpace identity selector; in particular, it does not require websites to support CardSpace. PassCard operates with both the CardSpace and the Higgins identity selectors without any modification. We describe how this new version of PassCard operates, and give security and usability analyses.

KW - CardSpace

KW - Password Manager

KW - Browser Extension

U2 - 10.1145/2070425.2070467

DO - 10.1145/2070425.2070467

M3 - Conference contribution

SP - 235

EP - 238

BT - Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011

A2 - Orgun, M A

A2 - Elci, A

A2 - Makarevich, O B

A2 - Huss, S A

A2 - Pieprzyk, J

A2 - Babenko, L K

A2 - Chefranov, A G

A2 - Shankaran, R

PB - ACM

CY - New York

T2 - 4th International Conference on Security of Information and Networks (SIN 2011)

Y2 - 14 November 2011 through 19 November 2011

ER -

Al-Sinani HS, Mitchell CJ. Extending the Scope of CardSpace. In Orgun MA, Elci A, Makarevich OB, Huss SA, Pieprzyk J, Babenko LK, Chefranov AG, Shankaran R, editors, Proceedings of the 4th International Conference on Security of Information and Networks, SIN 2011, Sydney, NSW, Australia, November 14-19, 2011. New York: ACM. 2011. p. 235-238 doi: 10.1145/2070425.2070467