Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Save password on chrome? Think again chrome://chrome/settings/passwords

james-singh.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Save password on chrome? Think again chrome://chrome/settings/passwords

#21

Post by S4M »

nobbitthehobbit wrote: post #5

What do you think it should do instead? There is no way for it to encrypt the passwords without having to ask you to enter a master password each time it starts. You could argue that it shouldn't let you see them through the user interface, but I would argue that this would be useless - security through obscurity.

I have no background at all in IT security, but I thought the passwords would be encrypted using a RSA system (the public key would be used to encrypt the password, the private key would be used to read them). The private key would be generated randomly when the browser is built, making it unique, and inaccessible (unless maybe with a debugger, but that's not something that could be done in couple of minutes).

Maybe what I just said is stupid and not feasible, in which case I'd be curious to know why.

Re: Save password on chrome? Think again chrome://chrome/settings/passwords

#23

Post by runarb »

michh wrote: post #6
cocoflunchy wrote: post #2

This is the main problem with Chrome for me at the moment. How hard can it be to add a master password prompt before showing the passwords? Or even to only store them encrypted? I know they wouldn't really be safe even if encrypted, but I just want them not to be available to any random person that has access to my computer for 3 minutes...

A random person with access to your computer could easily install a keylogger in those 3 minutes.

True, but that requires much more technical know-how.

For one you need to have a keylogger available when the victim is away from the computer. The keylogger may also be detected by a virus killer, now or it he further. The key logger most also send the passwords somewhere, leaving a forensic trace (or the culprit must get access to the computer again to retrieve the passwords).

The chrome "hack" on the other hand can easily be done if you have the opportunity and require no technical know-how or preparations. It also leaves no trace.

Re: Save password on chrome? Think again chrome://chrome/settings/passwords

#24

Post by vincentkriek »

tatsuke95 wrote: post #13
codeka wrote: post #3

This is true of Firefox and (possibly?) IE as well, though IE doesn't have an option to show the passwords in the UI. If a user has access to your desktop, then it really doesn't matter if your saved passwords are stored in plain text, you've already lost. And what's the alternative? Ask for a "master" password every time Chrome wants to auto-complete a password for you? That's what extensions like lastpass do, but I…

> "That's what extensions like lastpass do, but I don't think it makes sense for that to be the default." LastPass keeps you logged in to your "vault" either while the browser remains open, or by time limit. So you're really only entering the master password once per session. I think Firefox has a similar feature; you enter a master password the first time you try to access your passwords. People not using features l…

If I want to read my password I need to enter my master password again. Even when I'm logged in. You could log into the website without the master password but reading the password needs it.

Re: Save password on chrome? Think again chrome://chrome/settings/passwords

#26

Post by morsch »

On Linux Chrome (or just Chromium?) can use your system keyring to store passwords in a fairly secure manner. Now if only a) Firefox did that, too, and b) they could agree on a common standard so that you could share passwords between browsers.

See e.g. http://code.google.com/p/chromium/wiki/LinuxPasswordStorage

Re: Save password on chrome? Think again chrome://chrome/settings/passwords

#27

Post by nikcub »

This is not a security issue, as many have already pointed out. In this way it is related to the 'stored password XSS vulnerability':

http://news.ycombinator.com/item?id=4847505

Two things that need to be debunked.

First, Chrome does encrypt stored passwords. If you open the SQLite database in your profile and query the logins table you won't see a plain text password. For more on how Chrome stores passwords and the code behind it, see this post:

http://www.switchonthecode.com/tutorials/how-google-chrome-s...

Second, Chrome does have a master password. Most users just don't notice it, because instead of being implemented in the application it integrates with the operating system.

You need to be logged in and have access to the Keychain to open the file. Most users leave their keychains open by default when logging into OS X.

Post reply on HN