Aggie researchers say a new browser extension could eliminate the need for passwords. Trying to remember passwords for every website can be a challenge. And when using a password vault, a single breach can expose dozens or even hundreds of passwords. Researchers created “HIPPO,” a browser extension that creates passwords for each website without saving them. HIPPO (Hidden Password, Password manager Online) uses one master password for users to remember. It combines it with the website’s address, generates the correct password only at the moment of login working in tandem with a server, and does not need to store it anywhere, even on that server. “From the site’s perspective, nothing changes — the website still sees a normal password,” said Dr. Nitesh Saxena, professor of computer science and engineering and associate director of the Texas A&M Global Cyber Research Institute. He and his team published findings in IEEE Internet Computing, showing users prefer the new approach. HIPPO is the result of the work the team started more than 10 years ago. Passwords don’t exist until you need them: Researchers set out to see how people would respond to using HIPPO by giving 25 participants a series of realistic tasks: logging into an account repeatedly, changing passwords when a site required it, and using HIPPO as a browser extension. Thirty percent of participants reported not using a password manager, while the rest reported using one to varying degrees. Participants rated HIPPO higher than traditional password tools for both ease and satisfaction during login. They also viewed it as significantly more secure and more trustworthy, even though it introduced the extra step of activating the extension before typing the master password. Those results surprised even the researchers. “We went into this expecting a clear trade-off,” Saxena said. “More security usually means more hassle. What we saw instead is that people were actually happier once they stopped worrying about remembering or typing a complex password.” How it works: When you log in, HIPPO combines your master password with the website’s domain name and cryptographic protections to generate a randomized password unique to that site. Once you’re logged in, the password is then discarded. There’s no vault to steal, and no database on your laptop or browser or in the cloud. “For everyday users, one of the biggest pain points is when a website demands an updated password,” Saxena said. “That’s where a lot of people get fed up. You’re told to create something new, different, stronger, again and again. HIPPO handles that invisibly, so the user doesn’t have to play password gymnastics every few months.” Decreasing password anxiety: In the study, participants updated passwords using HIPPO and rated the experience as easy as traditional password changes, but more satisfying. Behind the scenes, HIPPO quietly generated a new version of the password without asking people to rethink or reinvent anything. More importantly, participants didn’t feel like HIPPO was doing something mysterious or risky. Many described it as “secure,” “random,” “hard to guess,” “simple,” and “easy.” Some even said they would use it for sensitive accounts like banking or email, places where password anxiety tends to run highest. Ditching storage: Password managers have been around for years, yet adoption remains uneven. Some people distrust them and master passwords can be forgotten. High-profile breaches of password vaults haven’t helped public confidence. Saxena says HIPPO sidesteps those fears by never storing passwords. “There’s something psychologically reassuring about knowing there isn’t a digital ‘safe’ full of your credentials somewhere,” he said. “Even if you trust the vault, it’s still a single point of failure. It’s like putting all of your eggs in one basket. HIPPO avoids that problem completely.” The study doesn’t claim HIPPO is perfect. Participants occasionally forgot to activate it, and researchers acknowledge that smoother cues and automation would help. The study also took place in a lab setting and followed users for a short time. Future real-world testing is planned. “The takeaway was striking,” Saxena said. “People not only tolerated a fundamentally different approach to passwords, they preferred it.” By Lesley Henton, Texas A&M University Division of Marketing and Communications
