SaTC: CORE: Small: Understanding, Analyzing, and Improving Password Authentication Practices across the Web

几十年来，密码一直是在线身份验证的基石，在可预见的未来很可能仍将如此。因此，网络生态系统、数十亿用户和全球经济的安全都严重依赖于网站如何管理密码认证。然而，每年都有攻击者成功地劫持了数百万个在线账户，这凸显了改进现实世界密码认证的迫切需要。为此，之前的研究已经探索了理解和改善用户的密码行为，但到目前为止，对网站及其运营商如何实际处理密码认证的考虑有限。从以网站为中心的角度来看，该项目将系统地调查网站采用的密码认证实践，以确定不安全方法的根本原因。根据所获得的见解，该项目还将开发创新的技术和非技术方法，以改进网站运营商实际采用的做法。最终，这项研究将通过影响网站运营商管理密码相关安全的方式，帮助提高整个网络的在线身份验证安全性。这可能会导致更好的安全标准（例如，web标准或密码标准）。研究成果将被广泛传播并整合到开源工具中，供网站开发者和管理员直接使用。为了实现这些目标，该项目将追求三个相互关联的重点。第一个重点是开发网络爬虫和分析技术，以大规模测量网站密码认证实践并评估其影响，为整个网络生态系统的在线认证安全状态提供新的可见性。第二个重点将采用用户研究和与网站运营商的实验，以建立一个社会技术的理解，为什么不安全的做法在现实中表现出来，考虑到人，组织，政策，法律和技术因素。最后，第三个重点将以从前两个重点中获得的见解为基础，开发实用的技术和非技术解决方案，以改善网站运营商管理密码身份验证的方式。这些解决方案将包括强化现有身份验证机制的设计和实现，减少采用安全实践障碍的工具，以及提高操作人员对不良实践的认识的方法。总之，这些互补的推力作为一个全面的努力，以提高web认证在实践中。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

For decades, passwords have served as a cornerstone of online authentication, and will likely remain so for the foreseeable future. As a consequence, the security of the web ecosystem, its billions of users, and the global economy are critically dependent on how websites manage password authentication. Yet each year, attackers successfully hijack millions of online accounts, highlighting a salient need to improve real-world password authentication. Towards this end, prior research has explored understanding and improving user password behavior, but to date, there has been limited consideration for how websites and their operators actually handle password authentication. Taking a website-centric perspective, this project will systematically investigate the password authentication practices employed by websites to identify root causes of insecure methods. Drawing on the insights gained, this project will also develop innovative technical and non-technical approaches for improving the practices actually adopted by website operators. Ultimately, this research will help advance online authentication security across the web, by impacting the way web-site operators manage password related security. This could possibly lead to better security standards (e.g., web standards or password standards). Research outcomes will be widely disseminated and integrated into open-source tools that website developers and administrators can directly use.To achieve these goals, this project will pursue three interconnected thrusts. The first thrust will develop web crawling and analysis techniques to measure website password authentication practices at scale and evaluate their implications, providing new visibility into the state of online authentication security throughout the web ecosystem. The second thrust will employ user studies and experiments with website operators to establish a socio-technical understanding of why insecure practices manifest in reality, considering human, organizational, policy, legal, and technical factors. Finally, the third thrust will build on the insights gained from the other two thrusts and develop practical technical and non-technical solutions for improving how website operators manage password authentication. These solutions will include hardened designs and implementations of existing authentication mechanisms, tools that reduce the barriers to adopting secure practices, and methods of raising operator awareness of poor practices. Together, these complementary thrusts serve as a comprehensive effort to improve web authentication in practice.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.