Every browser seems to implement its own password management scheme. None of them are as good as the same functionality that already exists in the operating system. Browsers should request access to passwords from the OS when needed, perhaps once per session.
How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
51–60 of 82 posts
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#52Earlier quoted context omitted.
Which, according to his findings with the dumpmon twitter bot, is not uncommon. Obviously you can make the case that YOU would use anti-virus software and YOU wouldn't let malware be installed on your computer, but in the end, you're still using a fairly insecure method to store your important passwords. And really, wouldn't a solution like LastPass be better in every way anyway?
I remember some software explicitly storing your saved passwords in plain text to make the point that storing it "encrypted" is in the end no different. Short of making you log in to your browser/password manager with a master password every time, how can you possibly store and retrieve passwords without letting other programs running with exact same permissions as you retrieve them?
The Mac OS X Keychain[1] acts as a gatekeeper and has fine grained permissions so you can let one application have default access to certain passwords (e.g., web passwords) but not other (IMAP/local file shares), or even to require the app to prompt you each time the app wants access to a password.
Of course, that's assuming all the software is well-behaved. You could have local malware that pops up a fake master password dialog, trick a user into filling it out, pulling the keychain out of the user's Library, then decrypting the whole keychain file manually.
Once there's malware running as the user himself, all bets are off. This is why iOS is probably the most secure OS out there - there's no chance for malware to get on the device.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#53Earlier quoted context omitted.
Laptops.
Show me a new laptop that isn't a netbook that is lower than 1024px wide. This guy is living in '99 designing solely for 800px wide screens.
We're not being clear: The Web page
'screens' I am putting up are just 800
pixels wide. I hope that usually the user's physical
screen has more pixels than 800 so that my
Web pages do not take up all of the
width of the user's physical screen.
For my Web pages, the 800 pixels is wide enough to get the information out there for the users to read easily. For my Web site, that my Web pages are only 800 pixels wide and, thus, usually don't take up the full width of the user's physical screen helps the UI/UX.
Even if the user's screen is 4096 pixels wide and three feet wide, I still only need 800 pixels of their screen!
For users with tablets, phones, etc. my Web pages should still be easy to use.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#54Chrome may be the most unsafe browser in the world just because how it gives away saved passwords in clear text with extreme ease. This is such a blatant violation of trust with users that developers who implemented this and thought this was OK shouldn't be allowed to work on anything related to security. They did not understood the simple fact that most users of Chrome do not have a clue about all these intricacies of software security. They use Chrome because they trust it to keep them safe. When they save their passwords they don't get any clear warning that many 7 year old can get all of their passwords in 30 seconds without installing or running any additional software on their machine.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#55Earlier quoted context omitted.
What's the problem? All you have do is click on Edit, Preferences, Security, Passwords, Use a Master Password. Easy as pie.
Why, that's almost as easy as remembering the new number to dial emergency services! http://www.youtube.com/watch?v=ab8GtuPdrUQ
How about I put it this way:
"All you have to do is go to password settings and click the button"
And you only have to go there once ever.
I think it's usually assumed users can navigate menus, because even if they can't there's not much you can do to help them at this point.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#56From http://www.chromium.org/Home/chromium-security/security-faq:
Why aren't physically-local attacks in Chrome's threat model?
People sometimes report that they can compromise Chrome by installing a malicious DLL on a computer in a place where Chrome will find it and load it. (See https://code.google.com/p/chromium/issues/detail?id=130284 for one example.) People also sometimes report password disclosure using the Inspect Element feature (see e.g. https://code.google.com/p/chromium/issues/detail?id=126398).
We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your computer as you, or who can run software with the privileges of your operating system user account. Such an attacker can modify executables and DLLs, change environment variables like PATH, change configuration files, read any data your user account owns, email it to themselves, and so on. Such an attacker has total control over your computer, and nothing Chrome can do would provide a serious guarantee of defense. This problem is not special to Chrome — all applications must trust the physically-local user.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#57Also in Chrome: Go to Settings -> Show advanced settings -> Manage saved passwords -> Click on a "hidden" password -> Click on "Show" button -> Voila, password shown in plain text
I did this on a Mac and got a modal dialog saying "Do you allow Chrome access to keychain item blah.com?" Click anything, get another modal dialog for bleh.com. I realized it was going to go through each and every password I've ever saved in Chrome. With modal dialogs. kill -9.
I separate high security passwords in to their own keychain with a different password. Every time I start chrome it prompts for access.
Out of all the things Chrome does this is one of the most annoying.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#58if I can channel RMS for a second; If you use Windows at this point, it's very clear that you do not care about security as much as you care about convenience. Whatever browser you attempt to put on top of that backdoor/COFEE-infested nightmare matters almost as much as what bikini you wear before jumping into a vat of acid.
That said, It's very good to know that Firefox is the safest of the three. If I ever again have the misfortune of advising windows users on the safest browser to use, I will definitely let them know that it would take far longer to compromise their passwords in firefox (even hours longer!) than the other browsers.
Myself, I'll stick to Firefox with the KWallet extension under Kubuntu.
Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
#59Chrome OSX stores in OSX keychain, out of the box. Which is a fairly secure way to store passwords.
Let's assume for the sake of argument that we are running code on both a Windows machine and an OS X machine, and trying to steal someone's browser passwords. While it is undeniable that the OSX keychain adds a roadblock to the theft, many average users would happily enter their password if the box was displayed when they ran up their browser (even if the browser wasn't the originating process) and likely also fall f…
Yes, but there is nothing that a program can do to prevent the user from hanging themselves. If an attacker has access to your hardware and user session then they can do almost anything, and at the OS level too.
At least Chrome extends the supplied OS security features and doesn't try to re-engineer them from scratch. This makes me more comfortable with Chrome rather than less.