Detecting and preventing password leakage using a device-level network filter

At least one non-transitory computer readable storage medium for detecting and preventing password leakage from a computing device using a device-level network extension and a password manager, the at least one non-transitory computer readable storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of the computing device, cause the computing device to perform the following steps:

• storing a user name, a password and a domain with which the user name and password are associated, for each account managed by the password manager;
• intercepting and filtering outbound network traffic locally within the computing device, by the device-level network extension;
• identifying passwords in the outbound network traffic intercepted and filtered by the device-level network extension;
• comparing target domains to which identified passwords are being transmitted to stored domains associated with identified passwords;
• determining whether attempts to transmit passwords to target domains are legitimate, based on results of the comparing;
• and
• responsive to determining that a specific attempt to transmit a specific password to a specific target domain is not legitimate, taking a corresponding security action.

A computing device comprising:

• system memory;
• a device-level network extension;
• a password manager residing in the system memory;
• a password storing module residing in the system memory, the password storing module being programmed to store a user name, a password and a domain with which the user name and password is associated, for each account managed by the password manager;
• a network traffic filtering module residing in the system memory, the network traffic filtering module being programmed to intercept and filter outbound network traffic locally within the computing device, in conjunction with the device-level network extension;
• an identifying module residing in the system memory, the identifying module being programmed to identify passwords in the outbound network traffic intercepted and filtered by the device-level network extension;
• a comparing module residing in the system memory, the comparing module being programmed to compare target domains to which identified passwords are being transmitted to stored domains associated with identified passwords;
• a determining module residing in the system memory, the determining module being programmed to determine whether attempts to transmit passwords to target domains are legitimate, based on results of the comparing;
• a security action taking module residing in the system memory, the security action taking module being programmed to take a corresponding security action, responsive to determining that a specific attempt to transmit a specific password to a specific target domain is not legitimate;
• and
• at least one processor configured to execute the modules.