  Users regularly enter sensitive data, such as passwords, credit card numbers,
or tax information, into the browser window. While modern browsers provide
powerful client-side privacy measures to protect this data, none of these
defenses prevent a browser compromised by malware from stealing it. In this
work, we present Fidelius, a new architecture that uses trusted hardware
enclaves integrated into the browser to enable protection of user secrets
during web browsing sessions, even if the entire underlying browser and OS are
fully controlled by a malicious attacker.
  Fidelius solves many challenges involved in providing protection for browsers
in a fully malicious environment, offering support for integrity and privacy
for form data, JavaScript execution, XMLHttpRequests, and protected web
storage, while minimizing the TCB. Moreover, interactions between the enclave
and the browser, the keyboard, and the display all require new protocols, each
with their own security considerations. Finally, Fidelius takes into account UI
considerations to ensure a consistent and simple interface for both developers
and users.
  As part of this project, we develop the first open source system that
provides a trusted path from input and output peripherals to a hardware enclave
with no reliance on additional hypervisor security assumptions. These
components may be of independent interest and useful to future projects.
  We implement and evaluate Fidelius to measure its performance overhead,
finding that Fidelius imposes acceptable overhead on page load and user
interaction for secured pages and has no impact on pages and page components
that do not use its enhanced security features.
