Why is this submission dead? Any ideas?
Chrome's insane password security strategy
71–80 of 315 posts
Re: Chrome's insane password security strategy
#72Earlier quoted context omitted.
It's especially insane on OSX which already has an OS-wide and ~secure (more secure than this anyway) password manager: Keychain.
Note that Chrome is using keychain and that you can dump the complete keychain data with all passwords decrypted via terminal anyway. You don't need any third party software ala Chrome installed. E.g.: security find-internet-password -g -s news.ycombinator.com Klick allow and that's it. The master password question for showing individual passwords in the Keychain.app does not protect your passwords. As others said: d…
Actually this is still better than Chrome does.
If you run that, you are prompted for access to it. If you click "Allow" the next time the command is called, you will be prompted again.
If you "Allow" when Chrome prompts for access to a keychain item it then creates a new keychain item and gives itself "always allow" access.
Re: Chrome's insane password security strategy
#73tl;dr - You're holding it wrong. Seriously, is the HN audience really that non-technical these days? Lol. I don't know what the clown who wrote that post is thinking, or the person that submitted it was, but seriously, how the heck did you think password storage works? It's like when everybody got up in arms about Pidgin storing passwords in cleartext. Heck, they even made a page explaining the rationale: https://dev…
I don't know what you're thinking.
Storing multiple encrypted passwords behind a single "master" password (in the case of Windows and OSX its usually the OS level User password) is a common way to provide convenience and security for users.
Re: Chrome's insane password security strategy
#74Showed this to the team I work with. Never seen so many jaws hit the floor. This is really bad. Passwords should never be viewable through a browser settings page. If you forget a password for a site, then the site provides a mechanism for password recovery/reset.
..and if it's this trivial to look at a password, why bother with [••••••• ] when auto-filling password fields. It's misleading.
I think that part is super useful. Sometimes I need to pull up a saved password for some common internal site, and this way I can do that comfortably even with friends or colleagues hanging over my shoulder!
Re: Chrome's insane password security strategy
#75Earlier quoted context omitted.
..and if it's this trivial to look at a password, why bother with [••••••• ] when auto-filling password fields. It's misleading.
I think that part is super useful. Sometimes I need to pull up a saved password for some common internal site, and this way I can do that comfortably even with friends or colleagues hanging over my shoulder!
Yeah, I get that... it's more of a UX failure (in light of this post) in that it suggests your password is ••••• when it's really *, but I guess that was factored into the UX considerations.
Re: Chrome's insane password security strategy
#76Why is this submission dead? Any ideas?
I don't know. It went from #4 to #58 in ten minutes.
Re: Chrome's insane password security strategy
#77I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.
Consider the case of someone malicious getting access to your account. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants.
We've also been repeatedly asked why we don't just support a master password or something similar, even if we don't believe it works. We've debated it over and over again, but the conclusion we always come to is that we don't want to provide users with a false sense of security, and encourage risky behavior. We want to be very clear that when you grant someone access to your OS user account, that they can get at everything. Because in effect, that's really what they get.
Re: Chrome's insane password security strategy
#78I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…
But it is a false sense of security.
Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not.
Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then it's compromised, fundamentally - but you're missing the far more likely scenario that this could be used, by, say, an unscrupulous employer, or a mistrustful spouse, or a child to get at daddy's porn passwords. People re-use passwords. Yes, it's bad behaviour, but what do you expect from a shaved ape? By making it possible to view these, you could grant the keys to the kingdom to any would-be eavesdropper.
It's not good. I understand your reasoning, but it's not connected to how people actually use their computers in reality.
Re: Chrome's insane password security strategy
#79I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…
But it is a false sense of security. Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not. Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then…
Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.
Re: Chrome's insane password security strategy
#80Earlier quoted context omitted.
But it is a false sense of security. Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not. Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then…
Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.
Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning.
I know, and you know, that locking one's account is the Thing To Do when not at one's terminal, but Joe User is still learning this, and in practice, most people do not lock their terminals when AFK, leaving them open to others in the household/dorm/school/office/whatever.
Yes, locking the account is the user's responsibility, but it wouldn't hurt to help them out, by not making it possible to view all a user's passwords in their chrome preferences.
Again, I'm aware that you could simply hop into keychain and check "show password", but this prompts for the user account password. At the very least, you should be doing the same.