How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
raidersec.blogspot.in
How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
1–10 of 82 posts
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#2Other side of an airtight hatchway? For this to be at all relevant, you're already got me running your binary with my user's permissions.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#3Other side of an airtight hatchway? For this to be at all relevant, you're already got me running your binary with my user's permissions.
Which, according to his findings with the dumpmon twitter bot, is not uncommon. Obviously you can make the case that YOU would use anti-virus software and YOU wouldn't let malware be installed on your computer, but in the end, you're still using a fairly insecure method to store your important passwords. And really, wouldn't a solution like LastPass be better in every way anyway?
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#4Other side of an airtight hatchway? For this to be at all relevant, you're already got me running your binary with my user's permissions.
Isn't this just the standard 'Windows is woefully insecure' problem? I would be curious to see how this works in the browsers on OS X.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#5Other side of an airtight hatchway? For this to be at all relevant, you're already got me running your binary with my user's permissions.
Isn't this just the standard 'Windows is woefully insecure' problem? I would be curious to see how this works in the browsers on OS X.
On OS X, the passwords are probably stored in the Keychain which would be much better than this.
Personally, I just disable all password storage on all browsers and use 1Password.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#6Other side of an airtight hatchway? For this to be at all relevant, you're already got me running your binary with my user's permissions.
Which, according to his findings with the dumpmon twitter bot, is not uncommon. Obviously you can make the case that YOU would use anti-virus software and YOU wouldn't let malware be installed on your computer, but in the end, you're still using a fairly insecure method to store your important passwords. And really, wouldn't a solution like LastPass be better in every way anyway?
I remember some software explicitly storing your saved passwords in plain text to make the point that storing it "encrypted" is in the end no different.
Short of making you log in to your browser/password manager with a master password every time, how can you possibly store and retrieve passwords without letting other programs running with exact same permissions as you retrieve them?
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#7Other side of an airtight hatchway? For this to be at all relevant, you're already got me running your binary with my user's permissions.
Hi there! Thanks for the great comment. I had a similar one on my blog that I responded to in the following way (I hope it helps!):
"Good question! You're right - in these cases it is assumed malware is already present on the system and running in the context of the user. But there can simply be better protection.
Consider Firefox's use of a Master Password. Even if an attacker is on the otherside of the airtight hatchway, he/she will not get the credentials unless they can find out the password used.
Thanks for the great comment!"
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#8Slightly off topic:
Why does Chrome, when the registration page includes both email and username fields, only remember the email but then insert it into the username field when you attempt to log in? I know some sites let you use the two interchangeably to login, but doesn't this seem like a silly assumption on Chrome's part? Why not remember both, and insert the username OR the email depending on what the field is called?
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#9Earlier quoted context omitted.
Isn't this just the standard 'Windows is woefully insecure' problem? I would be curious to see how this works in the browsers on OS X.
On OS X, the passwords are probably stored in the Keychain which would be much better than this. Personally, I just disable all password storage on all browsers and use 1Password.
Firefox will use the OSX keychain only if you install Keychain Services Integration: https://addons.mozilla.org/en-US/firefox/addon/keychain-serv... . I highly recommend it.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#10Earlier quoted context omitted.
Which, according to his findings with the dumpmon twitter bot, is not uncommon. Obviously you can make the case that YOU would use anti-virus software and YOU wouldn't let malware be installed on your computer, but in the end, you're still using a fairly insecure method to store your important passwords. And really, wouldn't a solution like LastPass be better in every way anyway?
I remember some software explicitly storing your saved passwords in plain text to make the point that storing it "encrypted" is in the end no different. Short of making you log in to your browser/password manager with a master password every time, how can you possibly store and retrieve passwords without letting other programs running with exact same permissions as you retrieve them?
You may be thinking of Pidgin:
https://developer.pidgin.im/wiki/PlainTextPasswords