31–40 of 315 posts
No, no, no, no, NO! What do you think "store password" means, when you click it? If you can fire up your browser and log in without ever typing in a password how could you EVER assume your passwords are stored in anything but plaintext? I'm sorry, this article just shows stupidity of the user rather than "Chrome’s insane password security strategy".
No, no, no, no, NO! What do you think "store password" means, when you click it? If you can fire up your browser and log in without ever typing in a password how could you EVER assume your passwords are stored in anything but plaintext? I'm sorry, this article just shows stupidity of the user rather than "Chrome’s insane password security strategy".
No, I want to store my passwords with strong encryption on my own machine, then unlock them for short periods, a-la the sudo password prompt.
No, no, no, no, NO! What do you think "store password" means, when you click it? If you can fire up your browser and log in without ever typing in a password how could you EVER assume your passwords are stored in anything but plaintext? I'm sorry, this article just shows stupidity of the user rather than "Chrome’s insane password security strategy".
Still, though, I find Chrome's practices in this respect rather crazy. The security I expect from the password manager is not that it will stop a person who really wants my passwords, but that it will allow me to lend my laptop to Joe Random Untechnical Friendquaintance to look at a web site, without feeling like I can't leave the room for two minutes because it's just that easy to see all my passwords. That's as simple as (say) a reversible hash.
I don't expect chrome's password saver to be secure: I'd just prefer it to not go out of its way to present passwords to the public. Or, at least, to make it very clear to users that their passwords can be seen that easily.
Finally, there's absolutely no reason why an untechnical user would know that chrome will give up their passwords like that - why would they?
Earlier quoted context omitted.
Logging in without typing a password is quite different from making your password visible in plain text. I take it you're a developer.
No it is not. Without taking any secret information from the user not available/stored in the system itself there is no way to store a password on a system that is not trivially retrievable by someone who has access to the computer.
tl;dr - You're holding it wrong. Seriously, is the HN audience really that non-technical these days? Lol. I don't know what the clown who wrote that post is thinking, or the person that submitted it was, but seriously, how the heck did you think password storage works? It's like when everybody got up in arms about Pidgin storing passwords in cleartext. Heck, they even made a page explaining the rationale: https://dev…
Shock! Firefox is insafe too! Call the presses, write the blogs! Go to any page where browser (Chrome or Firefox) pre-fills password. Click on the password, click on "inspect element", change the type of the form input from "password" to, say, "pasword". You just broke the internet security.
Firefox does have a master password.
Always seemed like a bit of a flaw that while you can't log in to other sites or view the passwords, you could still access any sites you were already logged in to.
Earlier quoted context omitted.
This probably is a mistake, far from harmless, but wouldn't it be better to point it out to the Chrome team and try to get it fixed. Have you logged a bug? https://code.google.com/p/chromium/ or Tools > Report an issue...
A mistake..? So they accidentally wrote code to copy your credentials and create a new keychain item which Chrome has permanent access to?
Earlier quoted context omitted.
Logging in without typing a password is quite different from making your password visible in plain text. I take it you're a developer.
No it is not. Without taking any secret information from the user not available/stored in the system itself there is no way to store a password on a system that is not trivially retrievable by someone who has access to the computer.
No, no, no, no, NO! What do you think "store password" means, when you click it? If you can fire up your browser and log in without ever typing in a password how could you EVER assume your passwords are stored in anything but plaintext? I'm sorry, this article just shows stupidity of the user rather than "Chrome’s insane password security strategy".
They're not stored in plaintext, they're stored in the Keychain. The point here is Chrome provides essentially unauthenticated access to the Keychain. For reference, here's what Safari prompts you with when you try to view your saved passwords: http://imgur.com/k2gIqtM
However I'll admit that there's a big difference between what I expected Chrome to be using those passwords for (logging me into websites) and how it's ended up (making those visible to anyone looking at the settings page).
To those saying this isn't insane... you are wrong. I can open anyone's chrome browser and access their passwords without a master password? That's plain fucked up. (I realise I could visit sites and use password reset, but this is so frictionless as to be insane)
Nb:not saying it is cool to be doing what they're doing.