Harbor: Phishing- and AiTM-Resistant Authentication with Recoverable Origin-Bound Passwords and Zero Server Changes

Abstract

Origin-bound password derivation makes a phished credential useless anywhere except the site on which it was captured, and it can be deployed with no server-side changes. The most complete prior client-only realization, AnchorPass (Al-jbour, 2026), nevertheless carries three practical costs that block adoption: a device-held secret (pepper) whose loss silently invalidates every account with no recovery path; a memory-hard hash recomputed on every login; and full-origin binding that breaks legitimate multi-subdomain sites. We present Harbor, a Chromium-based browser prototype whose trusted chrome contains a native credential bar below the address bar, and ROBD (Recoverable Origin-Bound Derivation), a scheme that resolves all three costs without weakening the security guarantee. ROBD replaces the pepper with a 128-bit recovery seed rendered once as a checksummed recovery code, preserving the same 2^{H\left(P\right)+128} offline hardness while making every site password recoverable on any device. It amortizes memory-hardness by running Argon2id once per unlock to produce a root key, then deriving per-site tokens with HKDF in under a millisecond. It scopes tokens to the registrable domain (eTLD+1) with public-suffix–aware separation of hosted-subdomain platforms, and separates HTTP from HTTPS. Because the credential bar lives in browser chrome, the master password is never typed into a page, and a credential firewall blocks the case where a user does so anyway. Across measured experiments—1,000 domain-binding trials, 1,005 cross-domain replay and adversary-in-the-middle (AiTM) relay attempts spanning 15 phishing techniques, latency benchmarks, an offline-cost analysis, a 12-pattern login-UI compatibility suite, and a 200-trial recovery test—Harbor achieves 0.0% replay success, 0.05 ms mean per-login derivation (vs. approximately 118 ms for the prior work), exact recovery in 200/200 trials, and correct field handling on 12/12 UI patterns. Harbor attains passkey-level phishing resistance while retaining password-level deployability and eliminating the loss and performance penalties of prior client-only schemes.