Secure password log in on insecure devices
One example method includes logging into websites through devices including insecure devices. A logon device may store credentials. The logon device is configured to connect with an insecure device and then communicate with a website for authentication purposes without exposing a user's credentials to the insecure device. After the user is authenticated, the session is transferred to the insecure device.
1. A method, comprising:
receiving a request, at a logon device, to log in to a website from a device;
determining whether the logon device stores credentials for the website in response to the request;
setting security levels for credentials stored on the logon device, wherein each security level is associated with a different password;
logging in to the website, by the logon device using the credentials for the website stored in the logon device, wherein the credentials are never in the clear to the device; and
transferring a session between the logon device and the website to the device such that the session continues between the device and the website.
2. The method of claim 1 , further confirming the request by the logon device.
3. The method of claim 2 , further comprising confirming the request by receiving input at the device or using authentication factors external to the logon device.
4. The method of claim 1 , wherein logging in to the website further comprises decrypting the credentials for the website and securely providing the decrypted credentials to the website.
5. The method of claim 4 , further comprising receiving session cookies from the website.
6. The method of claim 5 , further comprising transferring the session cookies to the device.
7. The method of claim 1 , further comprising loading the logon device with credentials of the user including the credentials to the website.
8. The method of claim 1 , further comprising pairing the logon device with the device, wherein the device is an insecure device.
9. The method of claim 1 , further comprising setting permissions for other devices including for the device.
10. The method of claim 1 , further comprising erasing the logon device in response to a trigger.
11. The method of claim 1 , wherein the logon device is wearable.
12. The method of claim 1 , further comprising rejecting the request when the credentials are not stored in the logon device or when a confirmation of the request is not received.
13. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving a request, at a logon device, to log in to a website from a device;
determining whether the logon device stores credentials for the website in response to the request;
setting security levels for credentials stored on the logon device, wherein each security level is associated with a different password;
logging in to the website, by the logon device using the credentials for the website stored in the logon device, wherein the credentials are never in the clear to the device; and
transferring a session between the logon device and the website to the device such that the session continues between the device and the website.
14. The non-transitory storage medium of claim 13 , further confirming the request by the logon device.
15. The non-transitory storage medium of claim 14 , further comprising confirming the request by receiving input at the device or using authentication factors external to the logon device.
16. The non-transitory storage medium of claim 13 , wherein logging in to the website further comprises decrypting the credentials for the website and securely providing the decrypted credentials to the website, receiving session cookies from the website, and transferring the session cookies to the device.
17. The non-transitory storage medium of claim 13 , further comprising loading the logon device with credentials of the user including the credentials to the website.
18. The non-transitory storage medium of claim 13 , further comprising:
pairing the logon device with the device;
setting permissions for multiple devices including the device; and/or
erasing the logon device in response to a trigger.
19. The non-transitory storage medium of claim 13 , further comprising rejecting the request when the credentials are not stored in the logon device or when a confirmation of the request is not received.